This page lists the service providers we use to run Sizewright and that process personal data on our behalf (subprocessors). For each one, it shows what the provider does, which data it receives, where it processes that data and which safeguard applies when data leaves the European Economic Area. The list applies from October 15, 2026; changes are recorded in the change log at the bottom.
Current subprocessors
| Provider | Purpose | Data | Location | Transfer safeguard |
|---|---|---|---|---|
| Cloudflare | Hosting of the website and platform, content delivery, network security and bot protection, file storage, processing containers, cookieless website statistics | All data that passes through the website and platform; stored files | Global network; stored files in the EU | EU-US Data Privacy Framework where certified; Standard Contractual Clauses |
| Neon | Database | Account, workspace, billing and content records | EU (Frankfurt, aws-eu-central-1) | Data stored in the EU; Standard Contractual Clauses for any access from outside the EEA |
| Stripe | Payments, invoices, tax calculation, fraud prevention | Billing details, payment details, email address, IP address, purchases | EU/US | EU-US Data Privacy Framework where certified; Standard Contractual Clauses |
| Resend | Sending transactional emails | Email address, name, email content | EU/US | EU-US Data Privacy Framework where certified; Standard Contractual Clauses |
| Anthropic | AI language and vision models (Claude): reading briefs, screening, art direction, copy, brand analysis, quality review | Briefs, brand kit details, website text and screenshots, images and banner renders a step needs | US | EU-US Data Privacy Framework where certified; Standard Contractual Clauses |
| fal.ai, and the image models it runs | Image generation, editing, extension, background removal and upscaling | Image prompts; images to be edited, which can include your uploads | US; model developers elsewhere | EU-US Data Privacy Framework where certified; Standard Contractual Clauses |
| Unsplash | Stock photo search | Search terms only | Worldwide | Not applicable: we send no personal data |
| Pexels | Stock photo search | Search terms only | Worldwide | Not applicable: we send no personal data |
| Sentry, if enabled | Error tracking for the website and the processing worker | Technical error details, which can include an IP address, browser details and a user id | EU/US | EU-US Data Privacy Framework where certified; Standard Contractual Clauses |
Notes per provider
Cloudflare
Cloudflare runs the website and the platform on its global network, so a request is handled close to where it comes from. Files you upload and the files Sizewright makes are stored in Cloudflare R2 in the EU jurisdiction. Cloudflare also runs the containers in which our worker renders banners and processes jobs, provides the bot protection on our sign-in forms (Turnstile) and counts website visits without cookies (Web Analytics).
Neon
Neon hosts our Postgres database in its EU region in Frankfurt. The database is encrypted at rest, and backups use Neon’s point-in-time restore.
Stripe
Stripe processes payments, calculates VAT and other taxes, creates invoices and checks payments for fraud. Card details go directly to Stripe; we never see your full card number. For some purposes, such as fraud prevention and its own legal obligations, Stripe acts as an independent controller under its own privacy policy.
Resend
Resend delivers the emails Sizewright sends, such as verification links, receipts, security notices and notifications.
Anthropic
Anthropic’s Claude models read briefs, screen them against our acceptable use policy, propose concepts, write and translate copy, analyze brands and review the quality of banners. They receive only what each step needs, never account email addresses or billing data. Under Anthropic’s commercial terms, data sent through its API is not used to train its models.
fal.ai and the image models
fal.ai gives us access to the image models that generate and edit imagery, extend images, remove backgrounds and upscale. Today, the models we use through fal.ai are FLUX.2 (Black Forest Labs), Recraft V4 (Recraft), Bria Expand and Bria RMBG (Bria) and SeedVR2. Depending on the model, fal.ai runs it on its own infrastructure or passes the request to the model’s developer. We ask fal.ai not to store the inputs and outputs of our requests, and the files it generates for us expire after one day. The data we send is not used to train the models, under the commercial terms that apply.
Unsplash and Pexels
When a concept uses a stock photo, we search Unsplash and Pexels with terms taken from the brief. These searches contain no personal data. The photos are not copied into our storage: your browser loads them from the provider’s servers, which then receive your IP address under the provider’s own privacy policy.
Sentry
Sentry is used only if we enable error tracking. When it is enabled, it receives technical details about errors so we can fix them, and we note that in the change log below.
Not subprocessors
Some services receive data from you or for you, but are not our subprocessors:
- Google, when you choose to sign in with Google. Google acts under its own terms and privacy policy.
- Have I Been Pwned, which we use to check new passwords against passwords known from data breaches. It receives only the first characters of a hash of the password, which is not personal data.
Changes to this list
We inform business customers who have accepted our data processing agreement at least 30 days before we add or replace a subprocessor, by email and in the change log below. They can object within those 30 days, as the data processing agreement explains. Questions about this list go to support@sizewright.com.
Change log
- 2026-10-15: first version.