Noryn Studio relies on a small set of third-party services (subprocessors) to operate. This page is the single, dated record of who they are, what they do, and what data reaches them. Each provider has its own privacy policy; we share only what the listed purpose requires.
Current subprocessors
| Provider | Purpose | Data it receives | Location |
|---|---|---|---|
| OpenAI | AI text generation, AI image generation, and (with Bring Your Own Media) short visual descriptions of your uploaded photos so the generated text matches them | Your input text and preferences; image generation prompts; with Bring Your Own Media, your uploaded photos (sent inline per generation, never as public links) | US |
| fal.ai | AI image and image-to-video generation | Generation prompts (derived from your input text) and AI-generated start images for image-to-video. Your uploaded Bring Your Own Media files are NOT sent to fal.ai; they are processed on our own servers | US |
| ElevenLabs | AI voice and text-to-speech for videos and slideshows | Voiceover script text derived from your input | US |
| HeyGen | AI avatar video generation (Pro plan) | Video script text | US |
| Gumroad | Payment processing and subscription management | Email address, payment details (handled entirely by Gumroad; Noryn never sees card numbers) | US |
| Resend | Transactional email (magic-link sign-in, service notices) | Email address, sign-in tokens | US |
| Railway | Application hosting and PostgreSQL database hosting | Request data processed by the application while serving you; account data, usage statistics, saved profiles and asset records (database) | US |
| Cloudflare | The network in front of noryn.io: every request to the site passes through Cloudflare, which also terminates the secure connection. Content delivery and media storage (R2), including the private bucket for Bring Your Own Media uploads. Since August 26, 2026, also cookieless traffic measurement (Cloudflare Web Analytics). | Generated media files; your uploaded Bring Your Own Media files (private bucket, access-controlled). As the network in front of the site it also sees, for each request, your IP address, browser user agent, the page requested and the site you arrived from. Traffic measurement records page views, page path, country, device type and referring site; it is cookieless and stores nothing on your device. | Global (EU/US) |
Notice policy for changes
Going forward, we will update this page at least 30 days before adding a new subprocessor or materially expanding the data an existing one receives. The only exception is an emergency replacement needed to keep the service secure or operational, in which case this page is updated as soon as possible and the change is dated in the log below.
Change log
- August 26, 2026: Cloudflare's role expanded. Cloudflare Web Analytics was switched on for noryn.io, replacing a previous setting that excluded visitors from the EU, so traffic measurement now covers all visitors. It is cookieless, stores nothing on your device, and does no cross-site tracking. The Cloudflare entry above was also corrected to describe the role it already had: the network in front of the site, which sees every request. Effective August 26, 2026; this page was updated the same day, so no 30-day advance notice was given for this change.
- July 28, 2026: database row corrected. Noryn's PostgreSQL database is hosted by Railway, alongside the application; the separate Neon entry was inaccurate and has been removed.
- July 8, 2026: OpenAI's role expanded. When you use Bring Your Own Media, your uploaded photos may be sent to OpenAI to produce short visual descriptions, so the generated text matches your photos. Effective July 8, 2026; disclosed on the Legal page the same day.
- July 8, 2026: page created. fal.ai and ElevenLabs, already in use and disclosed on the Legal page, are now listed here as well.
Questions about any subprocessor? Contact [email protected]. For your data rights, see the GDPR section of our Legal page.
Last updated: August 26, 2026