Sub-processors

Last updated [date] · To be notified of changes, [subscribe link]

OpenAI

• Purpose: large language model inference (vision) to generate alt text from submitted images and page context.
• Data involved: image content and prompt context, which may incidentally contain personal data.
• Location: United States. [Confirm contracting entity.]
• Transfer mechanism: UK-US Data Bridge if certified, otherwise UK IDTA/Addendum + transfer risk assessment.
• Note: contracted on API/business terms under which OpenAI does not train on submitted data.

Fly.io

• Purpose: application hosting and compute.
• Data involved: data in transit through the app and transiently in memory.
• Location: London (LHR) region for processing; control-plane/support access regions to confirm.

Supabase

• Purpose: PostgreSQL storage of descriptions, usage events and account data; authentication.
• Data involved: stored descriptions (may contain personal data), account data, usage logs.
• Location: [Confirm project region — EU/UK region simplifies transfers.]

Upstash

• Purpose: Redis for idempotency keys, rate limiting and job queueing.
• Data involved: identifiers and keys; confirm no substantive personal data.
• Location: [Confirm region.]

Stripe

• Purpose: payment processing and subscription billing (card data handled by Stripe; not stored by NarraSight).
• Data involved: billing contact and payment details.
• Location: [Confirm — Stripe processes globally with appropriate safeguards.]