Sub-processors
Every vendor that processes personal data on our behalf, what they do, and what we share with each.
Last updated · 2026-06-01
Under Article 28 GDPR (and equivalent provisions under UK GDPR / CCPA), we're required to maintain a current list of the sub-processors we use. The list below is the source of truth — when we add or remove a vendor, this page updates with it. Subscribe to changes by emailing privacy@fancy.pet.
Stripe, Inc.
- Purpose
- Payment processing and fraud detection
- Data shared
- Customer name, email, billing address, shipping address, payment method details, IP address.
- Processing location
- United States
- Their privacy policy
- https://stripe.com/privacy
Printify, Inc.
- Purpose
- Production and fulfilment of physical products
- Data shared
- Order details, customer name, shipping address, and the generated portrait file.
- Processing location
- United States / Latvia
- Their privacy policy
- https://printify.com/legal/privacy/
fal.ai (Features and Labels, Inc.)
- Purpose
- AI image generation, image analysis, and background removal
- Data shared
- Uploaded pet reference photos and generated portrait files. Photos are processed transiently and not retained on fal.ai's side beyond the request lifecycle. No customer name or email is shared.
- Processing location
- United States
- Their privacy policy
- https://fal.ai/privacy
Supabase, Inc.
- Purpose
- Database hosting, file storage, and authentication infrastructure
- Data shared
- All structured data we collect (gallery records, orders, email captures) plus uploaded photos and generated portraits.
- Processing location
- United States
- Their privacy policy
- https://supabase.com/privacy
Vercel, Inc.
- Purpose
- Website hosting, edge functions, and content delivery
- Data shared
- All HTTP requests to fancy.pet, which include IP address, user agent, requested URL, and any data submitted via forms or API calls during routing.
- Processing location
- United States
- Their privacy policy
- https://vercel.com/legal/privacy-policy
Resend, Inc.
- Purpose
- Transactional email delivery (download links, order confirmations)
- Data shared
- Recipient email address, pet name (when used in the subject line), order details, links to generated portraits and product mockups.
- Processing location
- United States
- Their privacy policy
- https://resend.com/legal/privacy-policy
Upstash, Inc.
- Purpose
- Redis cache used for rate limiting on API endpoints
- Data shared
- IP addresses and per-IP request counters. Counters auto-expire.
- Processing location
- United States
- Their privacy policy
- https://upstash.com/trust/privacy.pdf
International data transfers
Most of our sub-processors are based in the United States. When we transfer personal data from the UK or EEA to a non-adequate country, we rely on appropriate safeguards under Articles 45–49 GDPR — typically the EU-US Data Privacy Framework (where the vendor self-certifies) or Standard Contractual Clauses. Email us for the specific mechanism for any vendor above.
Changes to the list
We will update this page when we add, remove, or substantively change a sub-processor. Existing customers who have given us their email may opt in to receive a notification of any future change by emailing privacy@fancy.pet.