Subprocessor List
Last updated: 2026-06-03
| Provider | Purpose | Data categories | Region / transfer notes | Status |
|---|---|---|---|---|
| Supabase | Authentication, Postgres database, object storage, Row Level Security | Artist account data, client booking request data, magic-link token hashes, audit logs | EU (Frankfurt) | Confirmed live. Supabase Inc. DPA in force; sub-processor list at https://supabase.com/legal/dpa. |
| Vercel | Application hosting, edge functions, CDN | All in-transit traffic; minimal operational logs | EU functions region; operational and edge logs may transit to the US (DPF / SCCs) | Confirmed live. Vercel DPA in force; verify EU function region setting in production. |
| Resend | Transactional email delivery | Recipient email, sender, subject and body of transactional emails (including booking notifications), delivery metadata | EU region preferred; some routing may be US-based (DPF / SCCs) | Confirmed live. |
| Stripe | Payment processing for in-app card deposits via Stripe Connect (Express accounts; destination charges with on_behalf_of + application_fee_amount) | Card data entered directly into Stripe's hosted fields. Inklee never sees or stores card numbers. Inklee stores only Stripe identifiers (payment-intent ID, refund ID), deposit amount and status, and the platform-fee amount. | Global; transfers under DPF / SCCs | Confirmed live. Stripe is the independent controller of card data and the regulated PSP. The artist is the merchant of record for the deposit; the deposit settles into the artist's own Stripe account; Inklee never holds funds, only receives its platform fee. PSD2 / merchant-of-record re-confirmation requested from counsel. |
| Plausible Analytics | Cookie-free website analytics | Aggregated, non-identifying traffic metadata; IP address hashed and discarded | EU | Confirmed live. |
| Sentry | Error and performance monitoring | Stack traces, request metadata, potentially incidental personal data depending on context | EU region preferred; SCCs as fallback | Confirmed live. Configure data-scrubbing rules to minimise incidental personal data capture. |
| Upstash | Rate limiting (Redis) | IP addresses and request metadata; no booking content | EU region preferred; verify EU in production | Confirmed live. |
| Cloudflare | DNS, CDN, security, email routing (where used) | Connection metadata; routed email if Cloudflare Email Routing is enabled | Global edge network; transfers under DPF / SCCs | Confirmed live. |
| Google (OAuth) | Optional sign-in for artists | Identifier returned by Google OAuth (Google account ID, email, name, profile image) | Global; transfers under DPF / SCCs | Confirmed live. |
| GitHub (if applicable) | Source control; not a runtime subprocessor | None for user data at runtime | n/a | Listed for transparency; not a runtime data flow. |
| Meta Pixel | Marketing tracking | n/a | n/a | Not in use. Not deployed at the time of drafting. If enabled in future, this list must be updated and a consent banner introduced. |