1. Overview
ArtInStack (“we,” “us”) operates ArtInStack. To provide the Services, we use third-party companies that process personal data on our behalf (“subprocessors”).
This page:
- Describes our subprocessors as platform provider (when we are controller or when we engage vendors for the whole service).
- Supplements our Privacy Policy.
- Does not list every tool a Creator may choose on their own public site (e.g., their own analytics or ad networks). Creators remain responsible for subprocessors they enable for their audience.
For business customers who need contractual processor terms, see our Data Processing Agreement.
2. How we use subprocessors
We engage subprocessors to:
- Host applications and databases;
- Store and deliver media (images, video, files);
- Process payments and payouts;
- Send transactional email;
- Protect against abuse and monitor reliability;
- Fulfill print-on-demand orders when Creators use integrated labs; and
- Operate support, security, and compliance workflows.
We require subprocessors to protect personal data under written agreements appropriate to their role (e.g., data processing terms, vendor security requirements, or standard contractual clauses where transfers apply).
3. Current subprocessors
The table below is a representative list as of the effective date. Service names reflect categories we use in production or staging; exact entities may differ by environment (e.g., EU vs US data residency options offered by a vendor).
| Subprocessor | Category | Processing purpose | Typical data processed | Primary location(s)* | Privacy / security information |
|---|---|---|---|---|---|
| Stripe, Inc. | Payments | Subscription billing; checkout; Stripe Connect for Creator sales; fraud and compliance | Name, email, billing address, payment method tokens, transaction metadata, Connect account IDs | United States; may process globally per Stripe | stripe.com/privacy |
| Cloudflare, Inc. | Infrastructure & security | CDN, DNS, DDoS protection, edge caching; Turnstile bot protection; object storage (R2) for media | IP address, request logs, device/browser signals, stored files and metadata | United States; global edge network | cloudflare.com/privacypolicy |
| BunnyWay d.o.o. (Bunny Stream) | Video | Video hosting and streaming where enabled | Video files, playback metadata, viewer IP/logs | EU / global per Bunny configuration | bunny.net/privacy |
| Directus (self-hosted ) | Application data | CMS, application database, user and content records | Account data, content, settings, logs as stored in our database | us-central1 | directus.com/privacy |
| Resend, Inc. | Transactional email (auth, receipts, notifications) | Email address, message content, delivery events | United States | resend.com/legal/privacy-policy | |
| Functional Software, Inc. (Sentry) | Observability | Error and performance monitoring (if enabled) | IP address, device/browser data, stack traces, user IDs where attached to errors | United States | sentry.io/privacy |
| Prodigi Group (or affiliated entity) | Print fulfillment | POD production and shipping when Creator selects Prodigi | Shipping address, order details, print files | UK / EU / US per order routing | prodigi.com/privacy-policy |
| Gelato AS (or affiliated entity) | Print fulfillment | POD production and shipping when Creator selects Gelato | Shipping address, order details, print files | EU / global per Gelato | gelato.com/privacy |
| Google Cloud Platform | Hosting | Application containers, networking, secrets | Data processed by our apps in transit/at rest on infrastructure | us-central1 | policies.google.com/privacy |
* Primary location(s) are indicative. Many providers process in multiple regions and use subprocessors of their own. See each provider’s documentation for current details.
Optional / configuration-dependent
These may apply depending on features, plan, or Creator settings:
| Subprocessor | When used | Notes |
|---|---|---|
| Map tile providers (e.g., OpenStreetMap contributors via a tile CDN) | Impact maps, location visualizations on Creator sites | May receive approximate map viewport and IP; governed by tile provider terms |
| Analytics (if enabled on marketing site or Creator sites) | Usage measurement | Only where configured and, where required, after consent |
| Creator-enabled ad networks (e.g., Google AdSense) | Third-party ads on eligible Creator sites | Not our subprocessors for Creator audience data; Creator is responsible |
4. Creator commerce and fulfillment
When an End Customer buys from a Creator’s site:
- Stripe (and, where applicable, Stripe Connect) processes payment data according to Stripe’s role in that transaction.
- Prodigi or Gelato (or another integrated lab) receives production and shipping data needed to fulfill print orders.
For those flows, the Creator is generally the controller for End Customer personal data, and we process data as a processor under the Creator’s instructions, as described in our DPA.
5. Changes to this list
We may add or replace subprocessors as the Services evolve. For material changes to subprocessors that process personal data on our behalf as platform provider, we will:
- Update this page; and
- Where required by law or contract, provide at least 30 days’ notice to account holders (e.g., email or in-dashboard notice) before the new subprocessor begins processing, and an opportunity to object where mandated.
Continued use of the Services after the notice period may constitute acceptance where permitted. Enterprise customers with a signed DPA may have different notice or objection rights as stated in that agreement.
6. Security and due diligence
We evaluate subprocessors for security and privacy practices appropriate to the data they handle. This includes contractual obligations, access limitations, and alignment with our security program. Details of our security posture for the Platform are described on /features/platform-foundation and in product documentation—not a substitute for a customer security questionnaire or signed DPA.
7. Questions
DPA / B2B compliance.
Subprocessor / privacy questions: [email protected]