Sub-processors
Every vendor that processes personal data on our behalf, what they do, and what we share with each.
Last updated · 2026-10-02
Under Article 28 GDPR (and equivalent provisions under UK GDPR / CCPA), we're required to maintain a current list of the sub-processors we use. The list below is the source of truth, when we add or remove a vendor, this page updates with it. Subscribe to changes by emailing privacy@fancy.pet.
Stripe, Inc.
- Purpose
- Payment processing and fraud detection
- Data shared
- Customer name, email, billing address, shipping address, payment method details, IP address.
- Processing location
- United States
- Their privacy policy
- https://stripe.com/privacy
Printify, Inc.
- Purpose
- Production and fulfilment of physical products
- Data shared
- Order details, customer name, shipping address, and the generated portrait file.
- Processing location
- United States / Latvia
- Their privacy policy
- https://printify.com/legal/privacy/
Printful, Inc.
- Purpose
- Production and fulfilment of physical products
- Data shared
- Order details, customer name, email, phone (if given), shipping address, and the generated portrait file.
- Processing location
- United States / Latvia / other production countries
- Their privacy policy
- https://www.printful.com/policies/privacy
fal.ai (Features and Labels, Inc.)
- Purpose
- AI image generation, image analysis, and background removal
- Data shared
- Uploaded pet reference photos and generated portrait files. To check a photo (what kind of animal, eye colour), fal passes it through OpenRouter to a vision model run by Anthropic or Google. Generated images may sit on fal's file host for a short time before we copy them to our own storage. No customer name or email is shared.
- Processing location
- United States
- Their privacy policy
- https://fal.ai/privacy
Supabase, Inc.
- Purpose
- Database hosting, file storage, and authentication infrastructure
- Data shared
- All structured data we collect (gallery records, orders, email addresses and email choices, the unsubscribe list) plus uploaded photos and generated portraits.
- Processing location
- United States
- Their privacy policy
- https://supabase.com/privacy
Vercel, Inc.
- Purpose
- Website hosting, edge functions, and content delivery
- Data shared
- All HTTP requests to fancy.pet, which include IP address, user agent, requested URL, and any data submitted via forms or API calls during routing.
- Processing location
- United States
- Their privacy policy
- https://vercel.com/legal/privacy-policy
Resend, Inc.
- Purpose
- Email delivery: download links, order updates, "your painting is ready" notes, one review request after delivery, and (only if you ticked a box to agree) news, offers and checkout reminders
- Data shared
- Recipient email address, pet name (when used in the subject line), order details, links to generated portraits and product mockups.
- Processing location
- United States
- Their privacy policy
- https://resend.com/legal/privacy-policy
Upstash, Inc.
- Purpose
- Short-lived cache: rate limiting, the phone-to-computer photo hand-off, and photo-check results
- Data shared
- IP addresses and request counters; scrambled (hashed) email addresses used only to cap how many emails one address gets; links to photos you're handing from your phone (kept 15 minutes); the result of the photo check. Everything here expires automatically.
- Processing location
- United States
- Their privacy policy
- https://upstash.com/trust/privacy.pdf
Cloudflare, Inc. (Turnstile)
- Purpose
- Bot protection when you start a painting (only when switched on), so scripts can't run up our costs
- Data shared
- IP address and browser/device signals Turnstile reads to tell people from bots. No name or email.
- Processing location
- United States
- Their privacy policy
- https://www.cloudflare.com/privacypolicy/
PostHog Inc.
- Purpose
- Product analytics: page views, conversion funnel events (gen-started, add-to-cart, checkout, order placed), and session replays. We use this to understand where customers drop off in the flow and to debug issues.
- Data shared
- Page URLs, click events, IP address, device + browser metadata, and (when you give us your email to unlock downloads) your email address as a stable identifier. Session replays mask all form input values. Pet names, emails, addresses, and payment details are never recorded.
- Processing location
- European Union (Frankfurt region)
- Their privacy policy
- https://posthog.com/privacy
International data transfers
Most of our sub-processors are based in the United States. When we transfer personal data from the UK or EEA to a non-adequate country, we rely on appropriate safeguards under Articles 45–49 GDPR, typically the EU-US Data Privacy Framework (where the vendor self-certifies) or Standard Contractual Clauses. Email us for the specific mechanism for any vendor above.
Changes to the list
We will update this page when we add, remove, or substantively change a sub-processor. Existing customers who have given us their email may opt in to receive a notification of any future change by emailing privacy@fancy.pet.