Who processes your data
These third-party services process data on my behalf to run this service. I keep this list current and disclose every one, including the steps that run outside the EU.
| Vendor | Purpose | Location | Notes |
|---|---|---|---|
| Vercel | Website hosting, CDN | EU region | Front-end delivery |
| Supabase | Database, file storage | EU (eu-west-3) | Your images and data reside here |
| Google (Gemini) | AI image production | Outside the EU | The production step. Covered by your prior individual consent |
| OpenAI (GPT Image) | AI image production | Outside the EU | The production step, on the jobs where this model is chosen. The project is not set to EU data residency. Covered by your prior individual consent |
| Anthropic (Claude) | Brief qualification, prompt design, likeness quality check | USA | Receives brief text, and, when a quality check is run, the generated visual with the reference photographs |
| Stripe | Payment processing | USA | PCI DSS Level 1 |
| Resend | Transactional email | Processing region varies | Delivery notifications |
| Cal.com | Meeting scheduling | Outside the EU | Only if you book a slot from the link shown after you send a brief |
Some steps run outside the EU, because there is no equivalent inside it: production, on Google’s Gemini or OpenAI’s GPT Image depending on the model chosen for the job, and a likeness quality check, on Anthropic’s Claude, which compares the generated visual to your reference photographs so I can tell whether you still read as you. Every such transfer happens only after you have given written consent. I would rather state it plainly than bury it in a policy.
Related
This page sits alongside my privacy and data policy and my AI disclosure.
Last updated: September 9, 2026