Subprocessors

Last updated: 4 August 2026

Äng uses the third-party service providers (subprocessors) listed below to provide the Service. Each provider processes personal data only to the extent needed for the stated purpose, under a data processing agreement or equivalent contractual terms — either directly or through the provider that routes our requests.

We update this page when we add, replace, or remove a subprocessor. If you have an active Data Processing Agreement with us and want to be notified of changes, contact us at privacy@ang.studio.

Supabase

  • Purpose: Database, authentication, and file storage
  • Data processed: Account data (email, user ID), boards, images, files, and other user content
  • Location / transfer safeguard: EU

Vercel

  • Purpose: Application hosting, edge network, bot protection (BotID), AI Gateway model routing, and cookie-free web analytics (analytics only after consent)
  • Data processed: Technical request data (IP address, request logs), usage events; prompts and media for models routed through the AI Gateway (not including direct integrations such as Reve or fal.ai)
  • Location / transfer safeguard: Global edge network — EU–US Data Privacy Framework / SCCs

Google

  • Purpose: Sign-in (Google OAuth); Gemini / Veo models for image and video generation (via the AI Gateway); automatic visual analysis of library images for AI search; and Vertex AI hosting when agent chat is on Claude Sonnet 5 in Zero Data Retention mode
  • Data processed: Login identifiers; prompts, images, and files you submit or store that are processed by Google models or Vertex-hosted Sonnet agent requests
  • Location / transfer safeguard: EU/US — EU–US Data Privacy Framework / SCCs

OpenAI

  • Purpose: GPT Image models (via the AI Gateway); realtime voice transcription (only when you use voice input); and board agent chat via GPT-5.6 Luna on OpenAI when data retention is Standard or No Training (current trial)
  • Data processed: Prompts and images for GPT Image jobs; audio snippets and transcripts when you use voice input; conversation text, board context, and any images included in agent requests when Luna agent chat is enabled
  • Location / transfer safeguard: US — EU–US Data Privacy Framework / SCCs

Microsoft

  • Purpose: Azure OpenAI hosting for GPT-5.6 Luna board agent chat under strict Zero Data Retention (via the AI Gateway, current trial)
  • Data processed: Conversation text, board context, and any images included in those ZDR agent requests
  • Location / transfer safeguard: US/EU — EU–US Data Privacy Framework / SCCs

Anthropic

  • Purpose: Board agent chat and related text models when Claude Sonnet 5 is selected (via the AI Gateway; in Zero Data Retention mode those Sonnet requests are hosted on Google Vertex)
  • Data processed: Conversation text, board context, and any images included in agent requests
  • Location / transfer safeguard: US — EU–US Data Privacy Framework / SCCs

ByteDance

  • Purpose: Seedream image and Seedance video models (via the AI Gateway), only when you select those models
  • Data processed: Prompts, images, and related inputs for those jobs
  • Location / transfer safeguard: US/global — SCCs where applicable

Reve

  • Purpose: Layout-aware image generation and editing via a direct API integration, only when you select Reve models
  • Data processed: Prompts, images, and layout data for those jobs
  • Location / transfer safeguard: US — SCCs where applicable

fal.ai

  • Purpose: 3D model generation via a direct API integration (only when you use image-to-3D)
  • Data processed: Images you submit for 3D generation
  • Location / transfer safeguard: US — SCCs

Stripe

  • Purpose: Payment processing for subscriptions and credit top-ups (when paid features are used)
  • Data processed: Billing contact details, transaction metadata; card data is handled by Stripe, not stored by us
  • Location / transfer safeguard: US/EU — EU–US Data Privacy Framework / SCCs

Cloudflare

  • Purpose: Turnstile bot protection on public signup (when captcha is enabled)
  • Data processed: Technical challenge data and IP address during verification
  • Location / transfer safeguard: Global edge network — EU–US Data Privacy Framework / SCCs

Sentry

  • Purpose: Error monitoring and crash reporting
  • Data processed: User ID, email, device and error context (replays masked, PII scrubbed)
  • Location / transfer safeguard: EU (Frankfurt)

PostHog

  • Purpose: Product analytics (only after you consent to analytics)
  • Data processed: User ID (UUID only — never email or name), feature-usage events
  • Location / transfer safeguard: EU (Frankfurt)

Upstash

  • Purpose: Rate limiting (and legacy job-queue fallback when Supabase job storage is unavailable)
  • Data processed: User identifiers, request counters, transient job metadata
  • Location / transfer safeguard: Per deployment region — SCCs where applicable

Resend

  • Purpose: Transactional email (sign-in links, invites, lifecycle messages)
  • Data processed: Email address, message content and delivery metadata
  • Location / transfer safeguard: US — EU–US Data Privacy Framework / SCCs

Notion

  • Purpose: Internal management of in-app feedback (only when you submit feedback)
  • Data processed: Feedback message, your email address
  • Location / transfer safeguard: US — EU–US Data Privacy Framework / SCCs

Content delivery (no user content)

Some on-device features (such as background removal) download machine-learning model files from the jsDelivr and Hugging Face content delivery networks. Your browser's IP address is visible to these CDNs when fetching the files, but no user content or account data is sent to them.

See our Privacy Policy for how we handle personal data, our Data Processing Agreement for business customers, and our Cookie Policy for cookies and similar technologies.

← Back to sign in