Subprocessors
Last updated: August 2026
Version 2026-08.a
To deliver AIONLUMA we rely on a small number of third-party service providers — "sub-processors" — that process personal data on our behalf. Each one is bound by a written data-processing agreement under Article 28 GDPR, receives only the data its function requires, and may use that data only to provide its service to us.
This page lists every sub-processor currently in use. We update it before adding a new one.
1. Current sub-processors
| Provider | Purpose | Data received | Primary location |
|---|---|---|---|
| Supabase | Database, authentication and file storage | Account data, artifact metadata, uploaded media, email address | EU (Ireland) |
| Cloudflare | Object storage (R2), bot protection (Turnstile), CDN and DNS | Artifact media, IP address, request metadata | EU / global |
| Vercel | Application hosting, edge network, and cookieless web analytics | IP address, request metadata | Global |
| Modal | Serverless GPU compute for the forge pipeline | Uploaded video during processing (transient) | United States |
| Cloudprinter (and its authorized localized printing network) | Print production and order fulfilment | Recipient name and delivery address, the print file | EEA (Netherlands), and the country of production |
| Stripe | Payment processing | Payment details, billing information, email address | Ireland / United States |
| Odoo | Electronic invoicing and accounting (Italian fattura elettronica) | Billing name and address, VAT number, SdI code, PEC address, email, order and invoice details, and — for private buyers in Italy — the Codice Fiscale | EEA (Belgium; hosted in the EU) |
| Resend | Transactional and marketing email delivery | Email address, message content | United States |
| Upstash | Rate limiting (Redis) and background job queue (QStash) | IP address, rate-limit counters, job payloads | EU / global |
| Sentry | Error and performance monitoring | Error traces, technical metadata | EU / United States |
| Vercel AI Gateway | Routing and observability for AI-assisted drafting of support replies | Redacted support-email content | United States / global |
| Anthropic | AI drafting of support replies (Claude), reached through the Vercel AI Gateway | Redacted support-email content | United States |
| Fallback AI drafting of support replies (Gemini), reached through the Vercel AI Gateway | Redacted support-email content | United States |
2. How we use AI providers
Three of the providers above — Vercel AI Gateway, Anthropic and Google — are used for one purpose only: to draft a suggested reply when you write to our support address.
- They receive a redacted copy of the message, not your account, order or payment data.
- Requests are sent with retention disabled and model training switched off, so your correspondence is not kept by the provider and is not used to train their models.
- A member of our team reads and approves every suggestion before any reply is sent. No message you receive from us is generated and dispatched automatically.
We do not use AI to make decisions about you, to price your order, or to assess your uploads for any purpose other than the safety screening described in our Privacy Notice.
We hold no account with Anthropic or Google. Both are reached through the Vercel AI Gateway, which means Vercel engages them on our behalf and is contractually required to bind them to obligations at least as protective as its own — and remains responsible to us for what they do.
3. International transfers
Some providers process data outside the European Economic Area. Where they do, the transfer is covered by one of the safeguards recognised under Chapter V GDPR — an adequacy decision, the EU–US Data Privacy Framework, or the European Commission's Standard Contractual Clauses.
| Provider | Contracting entity | Safeguard |
|---|---|---|
| Supabase | Supabase Pte. Ltd. | Data stored in Ireland; EU Standard Contractual Clauses (Module 2) |
| Cloudflare | Cloudflare, Inc. | EU–US Data Privacy Framework, with EU Standard Contractual Clauses as automatic fallback |
| Vercel · Vercel AI Gateway | Vercel Inc. | EU Standard Contractual Clauses (Modules 1–3) |
| Modal | Modal Labs, Inc. | EU Standard Contractual Clauses (Modules 1–3) |
| Cloudprinter | Cloudprinter.com B.V. | Contracted in the Netherlands, inside the EEA. Our data processing agreement prohibits any transfer of personal data outside the EEA unless the destination is covered by an adequacy decision or another safeguard under Chapter V GDPR, including the European Commission's Standard Contractual Clauses. Cloudprinter must impose the same transfer obligations on any production partner it engages, and remains liable to us for what those partners do |
| Stripe | Stripe Payments Europe, Limited (Ireland) | EU–US Data Privacy Framework for the onward transfer to Stripe, LLC, with EU Standard Contractual Clauses as automatic fallback |
| Odoo | Odoo S.A. (Belgium) | Contracted in Belgium and hosted inside the EEA, so the invoice data itself is not transferred out of the EEA. Where a backup copy is held outside the EEA, it is held in a country covered by a European Commission adequacy decision. Where support staff of Odoo's non-EEA affiliates access data, Odoo binds them by the European Commission's Standard Contractual Clauses |
4. Changes to this list
We review this list whenever we add, replace or remove a service provider, and we update it before a new sub-processor begins processing your data. If a change materially affects how your personal data is handled, we will say so in the Privacy Notice as well.
Providers we have built an integration for but are not yet using are deliberately absent from this list. We add a provider when it actually begins to process personal data, not when the code to reach it exists.
5. Questions
To ask about a sub-processor, or to request a copy of the underlying agreements, write to [email protected].
See also our Privacy Notice.