These are the third parties that process personal data on our behalf to provide Vrandex Studio. We give at least 30 days' notice before adding or replacing a sub-processor. To get notices, email privacy@vrandexstudio.com with the subject "Subscribe to sub-processor updates".
Connected services you choose to connect (Shopify, WooCommerce, Klaviyo, Mailchimp, Vrandex Send) are not our sub-processors; you instruct us to exchange data with them, and their own terms apply.
Infrastructure#
| Sub-processor | Purpose | Data | Location | Transfer safeguard |
|---|---|---|---|---|
| Vercel Inc. | Hosting of the app and website, serverless functions, file storage (Vercel Blob) | All Service data in transit; uploaded files and generated images | EU region (Frankfurt) for functions; USA (company) | DPF / Standard Contractual Clauses |
| Neon Inc. (Databricks) | Managed PostgreSQL database | All Workspace data, account data | EU (AWS Frankfurt) | DPF / SCCs for support access from the USA |
| Clerk Inc. | Login, sign-up, sessions, user management | Name, email, Google profile, login events, IP address | USA | DPF / SCCs |
| Resend Inc. | Sending service emails (login codes, notifications) | Email address, name, email content | USA | DPF / SCCs |
| Hetzner Online GmbH | Static-IP proxy for calls to Shopify's API | Encrypted traffic to Shopify (content not readable by the proxy) | EU (Finland) | Within the EEA |
| Stripe Payments Europe Ltd | Payments and subscriptions | Billing name, email, address, VAT ID, payment details | EU (Ireland); USA (Stripe Inc.) | DPF / SCCs |
AI providers#
| Sub-processor | Purpose | Data | Location | Training on our data |
|---|---|---|---|---|
| Anthropic PBC | Text, layout and design generation; the Orbi agent; quality checks | Briefs, Brand DNA, product data, email content, screenshots | USA | No training on API data (commercial terms). DPF / SCCs |
| Google LLC / Google Ireland (Gemini API, paid) | Image generation and editing | Prompts, product images, reference images | USA / EU | Paid services: not used to improve Google's products. DPF / SCCs |
| Features & Labels Inc. (fal.ai) | Running image models: OpenAI GPT Image, Recraft, ByteDance Seedream, Bria, BiRefNet (background removal) | Prompts, product images, reference images, generated images | USA | fal may use anonymised derived data under its terms. SCCs |
| Higgsfield Inc. | Hero image generation (Soul model) | Prompts, reference and product images | USA | Yes: under Higgsfield's terms, non-Enterprise inputs may be used to improve its models. Workspace owners can switch it off in Workspace settings. SCCs |
| Photoroom SAS | Background removal and product photo cleanup | Product images | EU (France) | Per Photoroom API terms. Within the EEA |
Optional (only if switched on)#
| Sub-processor | Purpose | Data | Location | Transfer safeguard |
|---|---|---|---|---|
| PostHog Inc. | Product analytics (only with cookie consent) | Pseudonymous usage events, device data | EU (PostHog EU Cloud) | Within the EEA |
| Functional Software Inc. (Sentry) | Error monitoring | Error reports, technical data, user ID | EU (Sentry EU region) | SCCs for support access |
Changelog#
| Date | Change |
|---|---|
| [DATE] | First published list |