TanskyLab
Subprocessors
Last updated: September 19, 2026
These are the providers that process data on our behalf and under our instructions. Business customers on a Data Processing Agreement are notified at least 30 days before a new subprocessor is added, and may object. The full context is in the Privacy Policy; the agreement itself is at tanskylab.com/dpa.
| Provider | Purpose | Data | Location | Transfer basis |
|---|---|---|---|---|
| Supabase Inc. | Authentication, database, background jobs | Account data (e-mail, plan, settings), generation history, job metadata | European Union (Frankfurt, eu-central-1) | Data stays in the EU |
| Cloudflare, Inc. | Object storage (R2) for photos and generated files | Uploaded photos, relief maps, thumbnails, generated 3MF/STL files | European Union jurisdiction (R2 EU) | Storage restricted to the EU; company is US-based, SCCs in place |
| Vercel Inc. | Hosting and serverless compute (generation pipeline) | Technical data (IP address, request logs), data processed in-memory during generation | Functions run in Frankfurt (fra1); company in the United States | Standard Contractual Clauses |
| Resend (Plus Five Five, Inc.) | Transactional and product e-mail | E-mail address, message content, delivery events | United States | Standard Contractual Clauses |
| Kie.ai | AI photo preparation (only when you press Enhance) | A resized copy of the one photo you enhance and the selected instruction | United States | Standard Contractual Clauses; files deleted by the provider within 3 days |
| OpenAI, L.L.C. and xAI Corp. | Image models behind AI photo preparation, reached through Kie.ai | The same single photo and instruction; no account data is sent | United States | Standard Contractual Clauses; not used for model training |
| Paddle.com Market Ltd | Merchant of record, payments and invoicing for plans | Payment details, billing name and address, tax ID | United Kingdom and United States | Adequacy decision (UK), Standard Contractual Clauses (US) |
| Stripe, Inc. | Payments made before the switch to Paddle, and the MakerWorld campaign | Payment details, billing country | United States and Ireland | Standard Contractual Clauses |
| Google LLC | Sign-in with Google, if you choose it | Authentication token, basic profile information | United States | Standard Contractual Clauses |
What we do not do
- We do not sell, rent or trade personal data.
- Uploaded photos are never used to train any model, ours or anyone else's.
- No human reviews your photos: the pipeline is automated end to end.
- No contractor or freelancer has access to customer data.
Change history
- September 19, 2026 — Page published. Cloudflare and Resend added to the list; storage moved to an EU-restricted bucket and functions pinned to Frankfurt.