1. Overview
ArtInStack (“we,” “us”) operates the ArtInStack platform (the “Services”). To provide the Services, we engage third-party companies (“subprocessors”) that process personal data on our behalf.
This page:
- Lists the subprocessors we engage to run the platform. For personal data of Creators’ End Customers, we act as a processor on the Creator’s instructions, and these companies act as our subprocessors. For account and billing data of Creators themselves, we act as a controller and these companies are our service providers.
- Supplements our Privacy Policy.
- Does not list tools that a Creator chooses to enable on their own site (for example, their own ad networks or analytics). Creators are responsible for those tools. See Creator-enabled tools below.
“Creator” and “End Customer” have the meanings given in our Terms of Service. For business customers who need contractual processor terms, see our Data Processing Agreement.
2. How we use subprocessors
We engage subprocessors to:
- Host applications, databases, and backups;
- Store and deliver media (images, video, files);
- Process payments, tax calculation, and payouts;
- Send transactional email;
- Send marketing and campaign email (Email Center);
- Protect against abuse and monitor reliability;
- Fulfill print-on-demand orders when Creators use integrated print labs;
- Serve map tiles and geocoding for location and impact features; and
- Measure usage of our own marketing website.
We require subprocessors to protect personal data under written agreements appropriate to their role, such as data processing terms and security requirements. Where personal data is transferred outside the EEA or UK, we rely on Standard Contractual Clauses (and any UK addendum where required), as further described in our Privacy Policy and DPA.
3. Current subprocessors
This list is complete as of the date shown as Last updated on this page. Locations are indicative: many providers process in several regions and use subprocessors of their own. See each provider’s documentation for current details.
| Subprocessor | Purpose | Typical data processed | Location | Privacy information |
|---|---|---|---|---|
| Google Cloud (Google LLC) | Application runtime, PostgreSQL database (Cloud SQL), backups, networking, secrets. Our content management system (Directus) is self-hosted on this infrastructure and is not a separate subprocessor. | Account data, content, settings, orders, and logs stored by the platform | Iowa, United States (us-central1) | policies.google.com/privacy |
| Cloudflare, Inc. | CDN, DNS, DDoS protection, edge caching, image resizing, custom-domain SSL, Turnstile bot protection, object storage (R2) for media and backups | IP address, request logs, device/browser signals, stored files and metadata | United States; global edge network. R2 production bucket region: Eastern North America (ENAM) | cloudflare.com/privacypolicy |
| BunnyWay d.o.o. (Bunny.net) | Video hosting and streaming (Bunny Stream) and CDN delivery of related assets | Video files, playback metadata, viewer IP and logs | Europe — primary storage Frankfurt (DE); global CDN edge | bunny.net/privacy |
| Stripe, Inc. | Subscription billing, checkout, tax calculation (Stripe Tax), Stripe Connect for Creator sales and payouts, fraud prevention and compliance | Name, email, billing address, payment method tokens, transaction and tax metadata, Connect account IDs | United States; may process globally | stripe.com/privacy |
| Resend, Inc. | Transactional email (sign-in, receipts, invitations, notifications) | Email address, message content, delivery events | United States | resend.com/legal/privacy-policy |
| Amazon Web Services, Inc. (Amazon SES) | Marketing and campaign email (Email Center): bulk sends; bounce and complaint handling | Email address, message content, delivery events | United States — N. Virginia (us-east-1) | aws.amazon.com/privacy |
| Functional Software, Inc. (Sentry) | Error and performance monitoring | IP address, device/browser data, stack traces, user IDs where attached to errors | United States | sentry.io/privacy |
| Google LLC / Google Ireland Limited (Google Tag Manager and Google Analytics 4) | Usage measurement on our marketing website only, and only after consent where required | Online identifiers, device and browser data, pages viewed, approximate location | United States; global | policies.google.com/privacy |
| Prodigi | Print-on-demand production and shipping when a Creator selects Prodigi (engaged via standard account signup) | Shipping address, order details, print files | UK / EU / US depending on order routing | prodigi.com/privacy-policy |
| Gelato | Print-on-demand production and shipping when a Creator selects Gelato (engaged via standard account signup) | Shipping address, order details, print files | EU / global depending on order routing | gelato.com/privacy |
| Stadia Maps, Inc. | Basemap tiles for the Impact Map and other location visualizations | Map viewport requests, IP address and request metadata | United States; may offer regional endpoints | stadiamaps.com/privacy/privacy-policy |
| Mapbox, Inc. | Place search and geocoding for location features | Search queries, approximate coordinates, IP address and request metadata | United States; may process globally | mapbox.com/legal/privacy |
Feature-dependent subprocessors
| Provider | When used | Notes |
|---|---|---|
| Global Biodiversity Information Facility (GBIF) | Conservation features: species name suggestions | Our servers query GBIF for taxon names and keys. No End Customer contact data is sent. |
Creator-enabled tools
Creators can enable the following on their own sites or workspaces. For these, the Creator decides whether and how they are used, and is responsible for the data they receive. We are not their processor for the Creator’s audience data.
- Ad networks and embeds: Google AdSense, Mediavine, Carbon, and similar providers, on eligible Creator sites.
- Dataset publishing to GBIF: a Creator or their institution may publish datasets under its own endorsed GBIF Publisher relationship. GBIF is then a destination the Creator chooses. See gbif.org/terms.
- Translation and AI (BYOK): where a Creator supplies their own API key for DeepL, Google Gemini, or OpenAI under Settings → Integrations → Translation, content the Creator chooses to translate is sent to that provider under the Creator’s own account and terms. See Multilingual site languages.
4. Creator commerce and fulfillment
When an End Customer buys from a Creator’s site:
- Stripe, including Stripe Connect, processes payment and tax data according to Stripe’s role in that transaction.
- Prodigi, Gelato, or another integrated print lab receives the production and shipping data needed to fulfill the order.
For these flows, the Creator is generally the controller of End Customer personal data, and we act as the Creator’s processor as described in our DPA.
5. Changes to this list
We may add or replace subprocessors as the Services evolve. Before a new subprocessor begins processing personal data on our behalf as platform provider, we will:
- Update this page; and
- Give account holders at least 30 days’ notice by email or in-dashboard notice.
To be notified of changes, email [email protected] with the subject Subprocessor updates.
If you object to a new subprocessor on reasonable data protection grounds, email [email protected] within 30 days of the notice. We will work with you in good faith to address the concern, which may include offering an alternative or allowing you to stop using the affected feature. Customers with a signed DPA may have different notice and objection rights as set out in that agreement.
6. Security and due diligence
We evaluate subprocessors for security and privacy practices appropriate to the data they handle, including contractual obligations, access limitations, and alignment with our security program. For an overview of our infrastructure, see Platform foundation. That overview does not replace a customer security questionnaire or a signed DPA.
7. Questions
DPA and business compliance: [email protected]
Subprocessor and privacy questions: [email protected]
Change history
- 2026-10-11: Revised list. Removed Directus as a subprocessor (self-hosted; described under Google Cloud). Added Google Tag Manager and Google Analytics 4 (marketing site), Stripe Tax, Bunny Stream/CDN with Frankfurt primary storage, Cloudflare R2 ENAM, Amazon SES us-east-1, Creator-enabled ad networks (Mediavine, Carbon), and BYOK translation providers. Clarified notice and objection via [email protected].