Legal

Subprocessors

Last updated: September 23, 2026

Every third party we share data with to run Story Wall Systems, what they receive, and why. Incorporated by reference into our Data Processing Agreement.

Infrastructure

These handle data because they run the application. There is no version of the product without them.

Vercel
Application hosting and serverless compute
Receives
Everything the application processes, in transit
Processed in
United States
Neon
Primary Postgres database
Receives
All application data at rest
Processed in
United States (AWS us-east-2)
Amazon Web Services — S3, Lambda, CloudFront
Photograph storage, image processing, delivery
Receives
Photographs and their derivatives; design files
Processed in
United States
Cloudflare
DNS, CDN and R2 object storage
Receives
Photographs in transit and cached derivatives
Processed in
Global edge

Features

These receive data only for the feature named. Several are optional and receive nothing unless a studio turns them on.

Clerk
Authentication and organisation membership
Receives
Studio user names, email addresses, hashed credentials
Processed in
United States
Stripe
Subscription billing, and Stripe Connect for client payments
Receives
Billing contact, payment method (held by Stripe), invoice amounts
Processed in
United States
Postmark
Transactional email delivery
Receives
Recipient address and message content
Processed in
United States
Twilio
SMS and voice, for studios who enable them
Receives
Recipient phone number and message content
Processed in
United States
Google — Calendar, Places, Maps
Calendar sync and address lookup, when a studio connects them
Receives
Calendar events for connected calendars; typed addresses
Processed in
United States
Sentry
Error and performance monitoring
Receives
Stack traces and request metadata
Processed in
United States

Automated processing and AI

Listed separately because they are the ones customers ask about, and because one of them handles biometric data.

Amazon Rekognition
Face grouping (optional, off by default) and descriptive image labels
Receives
Photographs, and the FACE TEMPLATES derived from them
Processed in
United States (us-east-2)
Anthropic, via the Vercel AI Gateway
Studio Memory — suggesting client facts from a connected mailbox — and assistive drafting
Receives
Correspondence with clients already in the studio's records
Processed in
United States

What none of them may do

Every subprocessor is bound by a written agreement that permits them to process data only to provide their service to us. None of them may sell it, use it for their own advertising, or train their own models on it.

Face templates are covered by additional restrictions set out in our Biometric Data Retention & Destruction Policy.

Changes

We will update this page before a new subprocessor begins handling customer data. If you have a Data Processing Agreement with us and want notice of changes, email hello@thephotographersframer.com and we will add you to the notification list.