Legal
Subprocessor List
The providers we engage to run Stylaform. This list forms part of the Data Processing Agreement. Adding or replacing a provider is announced at least 30 days in advance.
- Version
- 1.0
- Last updated
- 18 August 2026
Supabase, Inc. (Lovable Cloud)
- Service
- Application database, authentication and object storage
- Purpose
- Hosting the production database, user authentication and uploaded brand assets
- Data
- Account and authentication data, workspace and brand data, uploaded assets, usage and audit records
- Processing location
- European Union
- Transfer mechanism
- Processing in the EU; where support access originates outside the EEA, Standard Contractual Clauses apply
- Status
- Active since 18 August 2026 - privacy information
Cloudflare, Inc.
- Service
- Content delivery, edge compute, DNS and protection against attacks
- Purpose
- Serving the application and website, caching, and blocking abusive traffic
- Data
- Request metadata including IP address, user agent and requested URL
- Processing location
- Global edge network, including the EU and the United States
- Transfer mechanism
- EU-US Data Privacy Framework and Standard Contractual Clauses
- Status
- Active since 18 August 2026 - privacy information
Google Ireland Limited / Google LLC (Gemini models)
- Service
- AI model inference
- Purpose
- Generating and analysing brand directions, colours, typography, rules, findings and explanations
- Data
- AI Input and AI Output, which may contain brand content and incidental personal data
- Processing location
- European Union and the United States
- Transfer mechanism
- EU-US Data Privacy Framework and Standard Contractual Clauses. Contracted on a no-training basis for content submitted through the Service
- Status
- Active since 18 August 2026 - privacy information
Stripe Payments Europe, Ltd.
- Service
- Payment processing and subscription billing
- Purpose
- Taking subscription and credit pack payments, invoicing, tax handling and fraud prevention
- Data
- Billing contact details, VAT details, payment method identifiers, transaction records. Full card data is handled by Stripe and never reaches Stylaform
- Processing location
- Ireland, with group processing in the United States
- Transfer mechanism
- EU-US Data Privacy Framework and Standard Contractual Clauses
- Status
- Active since 18 August 2026 - privacy information
Resend, Inc.
- Service
- Transactional email delivery
- Purpose
- Sending sign-in links, invitations, notifications and service messages
- Data
- Email address, name, message content and delivery metadata
- Processing location
- United States
- Transfer mechanism
- Standard Contractual Clauses
- Status
- Active since 18 August 2026 - privacy information
Google Ireland Limited (Google Fonts)
- Service
- Web font delivery on the public website
- Purpose
- Serving the typefaces used by the public website
- Data
- IP address and browser details of website visitors, as a technical necessity of the request
- Processing location
- European Union and the United States
- Transfer mechanism
- EU-US Data Privacy Framework. We intend to self-host these fonts and remove this dependency
- Status
- Active since 18 August 2026 - privacy information
Objections to a new Subprocessor can be sent to stylaform@turtleworks.nl within the notice period, as described in clause 6 of the Data Processing Agreement.