Sub-processors
Last updated [date] · To be notified of changes, [subscribe link]
OpenAI
- Purpose: large language model inference (vision) to generate alt text from submitted images and page context.
- Data involved: image content and prompt context, which may incidentally contain personal data.
- Location: United States. [Confirm contracting entity.]
- Transfer mechanism: UK-US Data Bridge if certified, otherwise UK IDTA/Addendum + transfer risk assessment.
- Note: contracted on API/business terms under which OpenAI does not train on submitted data.
Fly.io
- Purpose: application hosting and compute.
- Data involved: data in transit through the app and transiently in memory.
- Location: London (LHR) region for processing; control-plane/support access regions to confirm.
Supabase
- Purpose: PostgreSQL storage of descriptions, usage events and account data; authentication.
- Data involved: stored descriptions (may contain personal data), account data, usage logs.
- Location: [Confirm project region — EU/UK region simplifies transfers.]
Upstash
- Purpose: Redis for idempotency keys, rate limiting and job queueing.
- Data involved: identifiers and keys; confirm no substantive personal data.
- Location: [Confirm region.]
Stripe
- Purpose: payment processing and subscription billing (card data handled by Stripe; not stored by NarraSight).
- Data involved: billing contact and payment details.
- Location: [Confirm — Stripe processes globally with appropriate safeguards.]