Legal
Sub-processors
Third-party vendors that process customer data on our behalf. Last updated October 15, 2026.
Current sub-processors
| Vendor | Purpose | Data location |
|---|---|---|
| Supabase | Auth + Postgres database + storage | US East (aws-us-east-1) |
| Hostinger | Website hosting, business email and marketing email | Singapore (website server) |
| Cloudflare | DNS, CDN and security | Global edge |
| Freemius | Payments: Merchant of Record (paid plans only) | Global (PCI DSS) |
| Anthropic | AI label reading and artwork check (only files you upload to these features) | US |
Website analytics and advertising
These services process data about visits to our public website, and only after the visitor allows it in the cookie banner. They do not receive your recipes, labels or account data. Google (Analytics 4, Tag Manager, AdSense; global) and Microsoft (Clarity; global). For advertising, Google acts as an independent controller under its own privacy policy. Details are in the Cookie Policy.
Changes to this list
We'll notify DPA-signed customers by email at least 30 days before adding a new sub-processor.
Data residency
Enterprise customers with EU-residency requirements: contact us. EU-region Supabase deployment available on the Business plan.