Sub-Processors
Last updated: February 2026
MageXo s.r.o. uses the following sub-processors to deliver the PhotoneAI service. This list is maintained as required by our Data Processing Agreement.
Last updated: February 2026
If you are a customer with a DPA in place, we will notify you at least 30 days before adding a new sub-processor. You may subscribe to updates by contacting info@photoneai.com.
| Sub-Processor | Purpose | Data Processed | Location | Transfer Mechanism |
|---|---|---|---|---|
| Supabase Inc. | Database, authentication, and file storage | User accounts, product data, generated images, styles, scenes, shop analyses, credit transactions | United States (AWS us-east-1) | SCCs (EU 2021/914) |
| Google LLC | AI image generation and content analysis (Gemini API) | Product images, product descriptions, website screenshots, AI prompts, generated images | United States | EU-US Data Privacy Framework + Google Cloud DPA |
| Stripe Inc. | Payment processing and subscription management | Email addresses, Stripe customer IDs, subscription data, payment methods (PCI DSS Level 1) | United States | EU-US Data Privacy Framework + Stripe DPA |
| Resend Inc. | Transactional email delivery | Email addresses, email content (job results, image URLs, verification links) | United States | SCCs (EU 2021/914) |
| Vercel Inc. | Website hosting, CDN, and analytics | Anonymous aggregated performance metrics (no personal data in analytics) | United States (global edge network) | EU-US Data Privacy Framework + Vercel DPA |
| Google LLC (Google Analytics 4) | Web analytics (consent-based) | Anonymized page views, interactions, device info, geographic region (country-level). Collected only with explicit user consent. | United States | EU-US Data Privacy Framework + Google Ads Data Processing Terms |
| Intuition Machines Inc. (hCaptcha) | Bot detection and abuse prevention | IP addresses, browser characteristics (processed by hCaptcha, not stored by MageXo) | United States / European Union | SCCs (EU 2021/914) |
Infrastructure Providers
Our sub-processors may use underlying infrastructure providers (e.g., AWS, Google Cloud Platform) as part of their service delivery. These are covered by the respective sub-processor's own DPA and security certifications.
Changes
We review our sub-processor list regularly. Changes are communicated to customers with active DPAs at least 30 days in advance.
Questions
For questions about our sub-processors or to request copies of relevant DPAs, contact info@photoneai.com.