Who processes your data
These third-party services process data on my behalf to run this service. I keep this list current and disclose every one, including the step that runs outside the EU.
| Vendor | Purpose | Location | Notes |
|---|---|---|---|
| Vercel | Website hosting, CDN | EU region | Front-end delivery |
| Supabase | Database, file storage | EU (eu-west-3) | Your images and data reside here |
| Google (Gemini) | AI image production | Outside the EU | The production step. Covered by your prior individual consent |
| Stripe | Payment processing | USA | PCI DSS Level 1 |
| Resend | Transactional email | Processing region varies | Delivery notifications |
The production step runs on Google’s Gemini outside the EU, because there is no equivalent inside it. That transfer happens only after you have given written consent. I would rather state it plainly than bury it in a policy.
Related
This page sits alongside my privacy and data policy and my AI disclosure.
Last updated: August 7, 2026