elastudio Sub-processors
Version 1.4. Effective date: 27 October 2026. Version 1.3 applied earlier on 27 October 2026, version 1.2 from 22 October 2026 to 26 October 2026, version 1.1 from 15 October 2026 to 21 October 2026, and version 1.0 from 13 October 2026. For a studio that accepted an earlier version, version 1.4 applies when the studio accepts it; until then the earlier version applies, and Brevo and Focus NFe cannot be connected.
This list shows the companies elastudio uses to process personal data. It forms part of the Data Processing Agreement (DPA). We give studios at least 30 days’ notice by e-mail before adding or replacing a sub-processor, and studios can object (DPA section 5). Only in an emergency, such as a provider suddenly stopping service, may the notice be shorter (DPA section 5.3). Published at elastudio.app/legal/subprocessors. Studios receive change notices at their owner account e-mail; anyone else can ask to be notified at privacidade@elastudio.app.
elastudio is operated by Edilson Brito Bezerra Junior, operating as BRITO.AI, a sole proprietorship registered in Ontario, Canada.
A. Sub-processors of Studio Personal Data
These process the personal data described in Annex 1 of the DPA (members, guests, staff and teachers) on the studio’s behalf. elastudio’s own account and billing data about studio owners and staff is covered by the Privacy Policy.
Brazil (LGPD). Transfers from studios in Brazil to elastudio are governed by the ANPD standard contractual clauses in Annex 3 of the DPA. Under Clause 3 (Option B) and Clause 18 of those clauses, elastudio may pass data on only to the sub-processors below (and to the studio’s own Stripe account and, when the studio connects them, its own Brevo account and its own Focus NFe account, section B). Each sub-processor is bound by a written contract that requires it to process the data only on elastudio’s instructions, keep it confidential and secure, report security incidents, help with data subject requests, delete it at the end of the service and control its own sub-processors, and elastudio stays responsible to the studio for them. Stripe, Brevo and Focus NFe are bound instead by the studio’s own agreement with them (section B).
| Company | What it does for elastudio | Personal data involved | Where | Transfer safeguards | Its own sub-processors |
|---|---|---|---|---|---|
| Cloudflare, Inc. | Hosting and running the app (Workers), database (D1), file storage (R2) for logos, photos, import files and bug report screenshots, background jobs (Queues), sending transactional e-mails (Cloudflare Email Service), protection against attacks | All data in Annex 1 of the DPA | Database and files: eastern North America (Cloudflare offers no Canada-only option, so treat it as the United States; no copies kept in other regions; backups kept 30 days in the same Cloudflare account and region). Network: worldwide; the app runs in the Cloudflare data centre closest to the visitor, which can be in any country | Brazil: Cloudflare’s data processing terms (part of its Self-Serve Subscription Agreement) as the written contract under Clause 18 of the ANPD clauses; Cloudflare does not offer the ANPD clauses themselves (checked 11 October 2026). Canada: contractual protections | https://www.cloudflare.com/gdpr/subprocessors/cloudflare-services/ |
| Google LLC (Google Workspace) | elastudio’s support e-mail (support@elastudio.app) and privacy mailbox (privacidade@elastudio.app), where studios or members may send personal information when asking for help | Whatever a studio or member includes in an e-mail | United States and other countries | Brazil: Google’s Cloud Data Processing Addendum as the written contract under Clause 18, which also contains ANPD standard contractual clauses (checked 11 October 2026). Canada: contractual protections | https://workspace.google.com/terms/subprocessors.html |
| Anthropic, PBC | AI triage of bug reports sent by studio staff: suggests a title, category and severity (Anthropic also runs elastudio’s help assistant, which is not designed to receive studio data and cannot see any; see section D) | Only the text of the report, after e-mail addresses, phone numbers and similar contact details are automatically removed; the staff member’s role; and the page address with identifiers removed. Screenshots are never sent. Staff are asked not to include member names or health information, but anything typed in the report may still be sent. Anthropic does not train models on this data and deletes it within 30 days, except content flagged for abuse, which it may keep longer | United States, and other countries where Anthropic’s cloud providers operate (see its sub-processor list) | Brazil: Anthropic’s Commercial Terms and data processing addendum (applied automatically to elastudio’s API account) as the written contract under Clause 18 of the ANPD clauses; Anthropic does not offer the ANPD clauses themselves (checked 11 October 2026). Canada: contractual protections | https://www.anthropic.com/subprocessors |
| Plus Five Five, Inc., doing business as Resend | Backup sender of transactional e-mails: used only when Cloudflare Email Service refuses a message for its daily sending limit or a rate limit; same sending domain (mail.elastudio.app) | Recipient e-mail address and name, the content of that message and its delivery events (open and click tracking off). Messages and logs kept up to 30 days (backups up to 7 days more), not deleted earlier when a member is deleted; bounced or complained addresses may stay on Resend’s suppression list until elastudio removes them; everything deleted within 90 days after the account is closed | United States (sending region us-east-1), and other countries where Resend’s sub-processors operate (see its list) | Brazil: Resend’s Terms of Service and Data Processing Addendum as the written contract under Clause 18 of the ANPD clauses; Resend does not offer the ANPD clauses themselves (checked 15 October 2026). Canada: contractual protections | https://resend.com/legal/subprocessors |
B. Services the studio contracts directly (not elastudio’s sub-processors)
Stripe. Payments run through each studio’s own Stripe account (a Standard connected account), under the studio’s own agreement with Stripe. Stripe is the studio’s provider, not elastudio’s sub-processor, and also acts as an independent controller for its own legal duties such as fraud prevention and anti-money-laundering checks. On the studio’s instructions, elastudio sends Stripe the member’s name, e-mail and purchase details. Card details, and Pix payments made through Stripe, are entered directly into Stripe and never reach elastudio. For studios in Brazil, this flow is listed as an authorised onward transfer in Clause 3 of Annex 3 of the DPA. The contracting Stripe entity depends on the studio’s country: Stripe Brasil Soluções de Pagamento - Instituição de Pagamento Ltda for Brazil, Stripe Payments Canada, Ltd. for Canada and Stripe Payments Mexico, S. de R.L. de C.V. for Mexico (elsewhere, the Stripe entity that agreement names for the studio’s country), with Stripe, LLC for personal data processing (stripe.com/legal/ssa, checked 11 October 2026; the Mexican entity checked 27 October 2026). Stripe’s privacy policy: https://stripe.com/privacy.
Brevo (optional e-mail marketing). A studio may connect its own Brevo account (Sendinblue SAS, France) to elastudio by pasting a Brevo API key, which elastudio stores encrypted and never shows again, and choosing one of its lists. A studio can connect Brevo only after it has accepted the current versions of the DPA, Annex 3 and this list, and confirmed that its member privacy notice names Brevo. Brevo is then the studio’s provider, under the studio’s own agreement with Brevo, not elastudio’s sub-processor; elastudio has no contract with Brevo. On the studio’s instructions, elastudio sends to that list only members aged 18 or older who agreed to marketing e-mails and have an e-mail address that is not suppressed (never members under 18): e-mail, first and last name, language, member since (date), first and last visit (dates), whether they have an active pass or membership and the date it ends, and whether they are a resident or a visitor, identified in Brevo by the member’s elastudio id. When a member withdraws consent, elastudio deletes the contact in Brevo and recreates it with the e-mail address only, blocklisted, so that no name or other detail stays in Brevo; when a member is archived or their address is suppressed, elastudio only takes them off the list. elastudio also updates the contact when the member changes e-mail address and deletes the contact in Brevo when the member is deleted. When a member unsubscribes in a Brevo e-mail, Brevo tells elastudio and elastudio withdraws the member’s marketing consent. elastudio keeps, per member, only the sync state, timestamps and a one-way hash (SHA-256) of the last address sent, never the address itself. When the studio disconnects, elastudio forgets the key and removes the notification it set up in Brevo; contacts already sent stay in the studio’s Brevo account. Brevo stores data in the European Union (OVH in France and Germany, Google Cloud in Belgium). For studios in Brazil, this flow is listed as an authorised onward transfer in Clause 3 of Annex 3 of the DPA. Brevo’s terms, with its data processing agreement (Appendix 3) and its sub-processors (Annex 2): https://www.brevo.com/legal/termsofuse/.
Focus NFe (optional service invoices, NFS-e; studios in Brazil only). A studio in Brazil that sells in reais may connect its own Focus NFe account (FOCUS NFE LTDA, CNPJ 07.504.505/0001-32, Florianópolis, Santa Catarina, Brazil) to elastudio by pasting its Focus NFe API token, which elastudio stores encrypted and never shows again, to issue its service invoices (NFS-e). The studio’s digital certificate (A1) stays with Focus NFe; elastudio never receives or holds it. A studio can connect Focus NFe only after it has accepted the current versions of the DPA, Annex 3 and this list, and confirmed that its member privacy notice names Focus NFe. Focus NFe is then the studio’s provider, under the studio’s own agreement with Focus NFe, not elastudio’s sub-processor; elastudio has no contract with Focus NFe. On the studio’s instructions, for each fully paid sale (or when the studio’s staff ask), elastudio sends Focus NFe: the buyer’s name; the buyer’s CPF or CNPJ, when the studio has it; for a buyer marked as having no CPF because they are a foreigner, their own country’s tax number (NIF) if they gave one, or the code that says it was not given (the buyer’s country is not collected); the buyer’s e-mail, only when the studio chose to have the invoice e-mailed (on by default); a description of what was sold, the amount and the date; and the studio’s own fiscal data (CNPJ, city, tax regime and service codes). Focus NFe then issues the studio’s NFS-e with the city or the national NFS-e system. When the studio turns on “Ask for the document at checkout” (off by default), the member checkout asks the buyer for their CPF or CNPJ, or to tick “I have no CPF (I am a foreigner)” and, optionally, give their foreign tax number; elastudio saves it on the member’s profile and uses it for later invoices. The studio’s staff can also type it on a sale or in the “Waiting for a document” list. When a member is deleted, elastudio clears the CPF, CNPJ or foreign tax number and the foreigner mark from the profile. elastudio’s own record of each invoice keeps no buyer data (only the link to the order, the invoice number, its status, the amount and the description). Issued invoices are tax records that the studio must keep under Brazilian tax law; they stay in the studio’s Focus NFe account, under its agreement with Focus NFe, and with the city or the national NFS-e system, and are not deleted when the member is deleted. When the studio disconnects Focus NFe, elastudio deletes the token; notes already issued stay listed in elastudio, without buyer data, and in the studio’s Focus NFe account. Documents saved on members’ profiles stay until the member is deleted, or until the studio asks elastudio support to clear them. Focus NFe is a Brazilian company. Its own terms govern where it hosts data: they say it keeps the XML and PDF of issued documents for at least 5 years while the service is active, and that some transfers may occur outside Brazil, without naming the countries. For studios in Brazil, this flow is listed as an authorised onward transfer in Clause 3 of Annex 3 of the DPA. elastudio’s built-in test provider sends nothing outside elastudio. Focus NFe’s terms of use (updated 23 September 2025): https://focusnfe.com.br/termos-de-uso.
The studio’s bank (Pix). Where a studio takes Pix payments into its own bank account, the bank is the studio’s provider, not elastudio’s sub-processor. elastudio has no connection to the bank and does not receive, read or keep the bank’s e-mails or statements. The studio’s staff check each payment in their bank’s app and mark it as paid in elastudio, which records the payer’s name and the date as staff enter them, with the amount.
C. Services that people connect with their own accounts
In these cases the person uses their own account with the provider, under the provider’s own terms. The provider acts as an independent controller for its account, and elastudio receives only what is listed.
| Company | What it is used for | What elastudio receives | Where |
|---|---|---|---|
| Google LLC (Google sign-in) | Optional “Sign in with Google” for members and staff | Name, e-mail and a Google account identifier | United States |
| Google LLC (Google Calendar) | Optional for teachers: their busy times block private session slots (read-only) and, if they switch it on, their classes and confirmed private sessions are kept in a calendar elastudio creates in their own Google account | Busy and free periods only, with no event titles, attendees or details. With the classes switched on, elastudio writes class or session name, room, place and address (never a member’s home address), studio name, booking and waiting-list counts and a link to its own calendar, and receives back only the ids, status and last change time of those events. No member names, contacts, notes or messages | United States |
D. Services elastudio uses for its own purposes (not sub-processors of studio data)
elastudio is the controller here. See the Privacy Policy. Cloudflare, Google Workspace, Resend and Anthropic, listed in section A, also process elastudio’s own account, website, support and bug report data for these purposes; their help assistant roles are listed below.
| Company | Purpose | Where |
|---|---|---|
| Stripe (elastudio’s own account, Canada) | Billing studios for their elastudio plan, including the Starter trial and its reminder e-mail | United States and Canada |
| Google LLC (Google Analytics 4) | Website statistics, only on elastudio.app’s public pages and only after the visitor accepts analytics cookies. Never loaded on the studio dashboard, studio booking pages or the booking widget. Google acts as elastudio’s processor under the Google Ads Data Processing Terms. Google signals and data sharing are off | United States |
| Microsoft Corporation (Microsoft Clarity) | Website usage insights (clicks, scrolls, session recordings with all page text masked), only on elastudio.app’s public pages and only after the visitor accepts analytics cookies. Never loaded on the studio dashboard, studio booking pages or the booking widget. Not linked to Microsoft Advertising. Microsoft acts under the Microsoft Clarity Terms of Use; Clarity may also set a Microsoft-wide identifier (MUID) that Microsoft may use for its own purposes (see the Cookie notice) |
United States |
| Cloudflare, Inc. (Cloudflare Access) | Sign-in protection for elastudio’s internal back office (elastudio’s administrator accounts) | Worldwide network |
| Anthropic, PBC (help assistant) | Writes the answers of the AI help assistant in the help centre (elastudio.app/help, elastudio.app/pt-br/ajuda and elastudio.app/es/ayuda), using only elastudio’s help articles. Receives the visitor’s question, the answer and earlier messages of the same conversation; no account, studio or member data. Visitors are told before their first question that it goes to Anthropic in the United States, and are asked not to type personal or health information. Anthropic does not train models on this data and deletes it within 30 days, except content flagged for abuse, which it may keep longer | United States, and other countries where Anthropic’s cloud providers operate |
| Cloudflare, Inc. (Cloudflare AI Gateway) | Carries help assistant questions from elastudio.app to Anthropic. Logging of questions and answers is switched off, so the gateway keeps no copy of them | Worldwide network |
E. On standby (not in use)
No provider is on standby. A provider prepared in the code but not switched on is listed here; before it is used for studio data we give the notice in DPA section 5.2 (or, in an emergency, section 5.3) and add it to Clause 3 of Annex 3.
Changes to this list
| Date | Change | Notice sent | Takes effect |
|---|---|---|---|
| 13 October 2026 | First published | Not applicable | On publication |
| 15 October 2026 | Version 1.1: Plus Five Five, Inc., doing business as Resend, added as backup sender of transactional e-mails (moved from section E to section A) | None needed: no studio had accepted version 1.0 (checked 15 October 2026) | On publication |
| 22 October 2026 | Version 1.2: Brevo added to section B as an optional e-mail marketing service the studio contracts directly | None needed: Brevo is not a sub-processor (section A is unchanged), and it receives data only from a studio that connects its own Brevo account | On publication |
| 27 October 2026 | Version 1.3: Focus NFe added to section B as an optional service invoice (NFS-e) provider that a studio in Brazil contracts directly | None needed: Focus NFe is not a sub-processor (the sub-processors in section A are unchanged), and it receives data only from a studio that connects its own Focus NFe account | On publication |
| 27 October 2026 | Version 1.4: Stripe’s Mexican entity (Stripe Payments Mexico, S. de R.L. de C.V.) named in section B, and the Spanish help centre (elastudio.app/es/ayuda) named for the help assistant in section D | None needed: no sub-processor is added or replaced (section A is unchanged) | On publication |