Draft pending legal review. This document is a complete working draft. Items in [square brackets] are company details still to be confirmed. It will be reviewed by a qualified lawyer before we take payments or rely on it; until then, contact m.shafih.akbari@gmail.com with any questions.
1.Current sub-processors
These companies process customer personal data on our behalf. We require each to be bound by a written contract with data-protection terms at least as protective as our Data Processing Addendum; where that contract is still being put in place, the table says so in [square brackets].
| Sub-processor | Purpose | Data | Location | Transfer mechanism |
|---|---|---|---|---|
| IONOS SE | Infrastructure: the servers that run the app and API, the database and its backups | All Service data | Germany (Berlin data centre) | None — processed in the EU |
| Groq, Inc. | AI inference: planning and refining designs from your brief, answering questions in the site assistant, and optional spam screening of forum posts | Prompts, briefs, design context, assistant messages | United States | EU SCCs + UK Addendum [under Groq's data processing addendum — signature pending] |
| Google LLC (Gmail / Google Workspace) | Sending transactional email (sign-up, password resets, invitations, security alerts, receipts) and the newsletter | Name, email address, message content | United States | EU–US Data Privacy Framework (Google LLC is certified); SCCs [moving to a dedicated transactional-email provider under a DPA] |
| Stripe, Inc. / Stripe Payments Europe, Ltd. | Payments, subscriptions and invoices — only when you buy a paid plan | Billing contact, payment details (held by Stripe), invoices | United States / Ireland | EU–US Data Privacy Framework; SCCs |
Website analytics (Plausible Insights OÜ, EU) will be added here if and when we enable it.
Items in [square brackets] are contract steps we are still completing; this page will be updated when they are signed.
2.Changes and objections
We give at least 30 days' notice before adding or replacing a sub-processor, by updating this page and — for customers with a DPA — by email to subscribers of these updates. To subscribe, or to object on reasonable data-protection grounds, write to m.shafih.akbari@gmail.com. If we cannot address a reasonable objection, you may terminate the affected service and receive a pro-rata refund of prepaid fees.