Legal · Transparency
Subprocessors
Last updated 2026-05-03
These third-party services process personal data on our behalf. Each has signed a data processing agreement consistent with GDPR Art. 28, CCPA, and PDPA. We update this list whenever we add or remove a processor.
| Subprocessor | Purpose | Data Touched | Region |
|---|---|---|---|
| Vercel | Application hosting + edge runtime | IP, request metadata, server logs | United States (Global edge) |
| Supabase | Database, authentication, storage | Account data, scan history, monitoring preferences (encrypted at rest). Face embeddings are NOT stored server-side — they live in your browser's IndexedDB cache. | United States |
| Cloudflare | Edge worker / image proxy / DDoS protection | Image bytes (transient, never logged), IP, request metadata | Global edge network |
| Public reverse-image search providers | Reverse-image face matching across public search engines | A derived face crop (not your original photo, not your identity) | Global |
| Modal.com | Machine learning inference fallback (face embedding) | Image bytes (transient, not stored) | United States |
| Resend | Transactional email delivery (alerts, receipts) | Email address, alert content | United States |
| Brevo | Transactional email fallback | Email address, alert content | European Union (GDPR-compliant) |
| Stripe | Payment processing (subscriptions, contingency payouts) | Billing address, payment method (we never see card numbers) | Global |
| PostHog | Product analytics (opt-out available) | Anonymized usage events, page views | United States / European Union |
| StopNCII.org | Hash-submission for non-consensual intimate-image takedowns | Perceptual hash (no image bytes leave your device) | United Kingdom |
| Inngest | Durable workflow orchestration (scheduled scans, retries) | Job metadata, workflow state | United States |
| Google Vision API | Image attribute detection (deepfake fingerprinting) | Public image URL submitted for analysis | Global |
| Hive AI | Content moderation (NSFW classification, AI-generation detection) | Public image URL submitted for analysis | United States |
| WhatsApp Cloud API (Meta) | Crisis-line messaging (opt-in only) | Phone number, message content | Global |
| LINE Messaging API | Bangkok agency communication (opt-in only) | LINE ID, message content | Japan / Thailand |
Notification of changes: we publish updates to this list before adding a new subprocessor. Material changes affecting EU/UK data subjects are announced 14 days in advance via email to enrolled users.
Sub-subprocessors:some processors above (e.g., Vercel, Supabase) use their own infrastructure providers (AWS, Google Cloud). Those are governed by each subprocessor's own DPA.
Data residency requests: contact admin@unimpersonationable.com for region-specific routing concerns.