Binder BlitzSub-processors and Third Parties
This page is only available in English. We keep our legal pages in a single language so the exact wording — and your rights under it — never gets lost or changed in translation. If you use your browser’s built-in translation, treat it as a convenience only: the English text here is what applies.
Summary
We use a small number of service providers. We do not sell personal data. Some providers act only on our instructions (“processors”); others receive your IP address when their files load in your browser. Items marked “if enabled” are used only if the operator has switched them on.
1. Who we use
| Provider | Purpose | Data involved | Location | Safeguards and link |
|---|---|---|---|---|
| Supabase | Database, sign-in (authentication) and file storage (carousel images) | Account data, profile, usage events, collection tracker, saved themes, contact messages, eBay tokens, uploaded images | Region chosen by the operator (see below); may involve the US | Data processing agreement with SCCs / UK Addendum; Data Privacy Framework where certified. Privacy policy |
| Render | Web hosting and server logs | IP addresses, request logs, and all traffic to the service | US or EU region chosen by the operator (see below) | SCCs / UK Addendum; Data Privacy Framework where certified. Privacy policy |
| Stripe | Card payments, subscriptions, invoicing and tax calculation | Email, billing details, card data (entered only on Stripe’s pages), tax location and IDs | US and other countries | Stripe acts as processor and, for its own compliance and fraud purposes, as independent controller; SCCs / UK Addendum; Data Privacy Framework where certified. Privacy policy |
| NOWPayments | Crypto payments (prepaid passes and top-ups) | Order ID, amount and the customer’s on-chain payment data. No account details or other personal data from us | Provider’s locations; see its policy | Minimal data shared; provider’s own terms. Provider website |
| Anthropic | AI processing: reading card photos, generating themes and answering support-chat questions | Card photos and text you submit to those features. No account email or payment data | Primarily the US | Commercial terms and data processing terms with SCCs / UK Addendum; Data Privacy Framework where certified. Privacy policy |
| Cloudflare Turnstile | Optional bot-protection challenge at sign-up (only if configured) | IP address, browser signals and challenge results | Global | SCCs / UK Addendum; Data Privacy Framework where certified. Privacy policy |
| Discord | Internal notifications to the operator only | Event type only (for example “new signup” or “new contact message”). No customer email or message body is sent | US | Minimal data; not shared with customers. Privacy policy |
| Resend (or a similar transactional email provider), if enabled | Sending service emails such as receipts, notices and support replies | Recipient email address and message content | US and other countries | SCCs / UK Addendum; Data Privacy Framework where certified. Only if enabled. Privacy policy |
| Google Fonts | Typefaces loaded from fonts.googleapis.com and fonts.gstatic.com | Your IP address and browser details are disclosed to Google when fonts load | Global | Google’s terms. We have no control over what Google does with that request. Privacy policy |
| flagcdn.com | Country flag images in the region picker | Your IP address and browser details when the images load | Global CDN | Provider’s terms. Provider website |
| jsDelivr, IMG.LY CDN and Tailwind CDN | JavaScript libraries and model files loaded in the Theme Builder and Image Studio tools (including the on-device background-removal model) | Your IP address and browser details when files load. Your photos are not sent to them | Global CDNs | Providers’ terms. jsDelivr privacy policy |
| Plausible Analytics, if enabled | Cookieless, aggregated site statistics | Page URL, referrer, coarse location and device type, without cookies or individual profiles | EU | Enabled only if configured; where required, only after consent. Data policy |
2. Where data is stored
Supabase and Render are set up in regions selected by the operator, Binder Blitz, when the projects are created. Other providers listed here may process data in the United States or other countries. To find out the current regions, or to ask which safeguards apply to your data, email keironjwest@gmail.com.
3. International transfers
Where personal data from the UK, EEA or Switzerland is transferred to a country without an adequacy decision, we rely on the UK International Data Transfer Agreement or UK Addendum, or the EU Standard Contractual Clauses. Where a provider is certified under the EU-US Data Privacy Framework and its UK Extension, transfers to that provider may rely on it, and only where the provider is certified. Details are in our Privacy Policy.
4. Changes to this list
We may add or replace providers. We will update this page before the change takes effect, and for a new processor of customer content we will give at least 30 days’ notice by email or in the app where practical. If you object to a new provider on reasonable data-protection grounds, contact keironjwest@gmail.com; if we cannot accommodate your objection you may close your account and claim a proportionate refund of any unused prepaid period.
5. What we do not do
- We do not send customer email addresses or message bodies to Discord.
- We do not send your card number to anyone: Stripe collects it directly.
- We do not use advertising networks or data brokers, and we do not sell or share personal data for cross-context behavioural advertising.
Binder Blitz’s controller details: Binder Blitz, United Kingdom. Contact keironjwest@gmail.com.