Carouza · Purple Labs Inc.
Sub-processors
Every third party that touches your data, what each one actually receives, and where it sits. Assembled by reading our own code, not from memory.
Effective [TO BE COMPLETED: effective date] · Last updated [TO BE COMPLETED: last updated date]
What this page is
To run Carouza we use other companies: a database, a host, an AI model, a publishing partner, a payment provider, a mail relay and an error tracker. Where those companies process personal data on our instructions they are our sub-processors, and the GDPR requires us to tell you who they are.
The last column is the file in our own source code where the integration lives. It is there so that this page can be audited rather than taken on trust.
Current sub-processors
| Vendor | What we use them for | What they receive | Where | In our code |
|---|---|---|---|---|
| Supabase | Database, authentication and file storage: the primary store for everything. | Your account and sign-in identity, your business profile, brand kit, carousels, captions, ideas, uploaded photographs, rendered slides, billing ledger and product events. | European Union: Frankfurt, eu-central-1 (D106) | src/lib/supabase/env.ts, src/lib/jobs/sweep.ts:56 |
| Vercel | Hosting for the website and the application, and the scheduler that runs our jobs. | All web traffic in transit, including your IP address and the requests your browser makes, plus our server logs. | Serverless functions in the European Union: Frankfurt, fra1. Static assets are served from Vercel's global edge network. | vercel.json, src/app/api/cron/route.ts |
| Anthropic | The AI model that writes and edits carousel copy, captions and ideas. | The text we send to generate or edit content: your business profile, the brief or website text you gave us, the slide copy being edited, and the model's replies. | United States | src/lib/ai/client.ts:70 |
| bundle.social | Publishing to Instagram and TikTok, and reading back the metrics for posts you published. | The caption and hashtags of a post you publish, the public URLs of the rendered slides (the vendor fetches the images itself), your connected account's handle, and the engagement figures the platform returns. Your Instagram and TikTok credentials are held by this vendor, not by us. | Not established in the repository | src/lib/social/bundlesocial.ts:27 |
| Stripe | Payments. Stripe is the seller of record for your subscription under Stripe Managed Payments. | Your email address, your Stripe customer and subscription identifiers, the plan you chose, and the billing and tax details you give Stripe directly. Card numbers are entered on Stripe's own hosted pages and never reach us. | United States, with global tax registrations as seller of record | src/lib/billing/stripe.ts:153, src/app/api/webhooks/billing/route.ts |
| Resend | Sending email as the mail relay behind Supabase Auth: sign-in codes and service notices. | Your email address and the contents of the message we send you. | Not established in the repository | supabase/config.toml:279 (smtp.resend.com, sender hello@mail.carouza.com) |
| Sentry | Error reporting, so we find out when something breaks before you have to tell us. | Stack traces and the release and environment they happened in, plus your user identifier. Not your IP address, not your cookies, not request bodies, and not your carousel content. A scrubber removes those before the report leaves our servers. | European Union, on the Sentry organisation's EU data region | src/lib/observability/sentry-options.ts:145, next.config.ts:8 |
| Google (Sign in with Google) | The optional "Continue with Google" sign-in button. | Only if you choose it: your email address and your Google account identifier. We request no other scopes, so we see nothing else in your Google account. | United States | supabase/config.toml:444, src/app/auth/google/route.ts:45 |
Not switched on yet
The following is built but not in use. Nothing is sent to it today. It is listed so that you are not surprised later, and separated so that we are not telling you your content goes somewhere it does not.
| Vendor | What it would be for | What it would receive | Where | In our code |
|---|---|---|---|---|
| Google (Gemini image generation) | Generating images on the Pro plan (D70). Not switched on. | When it is switched on: the image prompt we derive from your copy. Nothing is sent today. | United States | src/lib/ai/gemini.ts:630 (no caller, per src/lib/images/availability.ts:29) |
Where your posts go
These are not sub-processors, because they are not processing on our instructions. They receive your post because you told us to publish it to your own account there. They are listed because you are entitled to a complete picture of where your content ends up.
| Platform | What it receives | In our code |
|---|---|---|
| Instagram (Meta) | The carousel images, caption and hashtags of any post you publish, via bundle.social. | src/lib/social/bundlesocial.ts:33 |
| TikTok (ByteDance) | The carousel images and caption of any post you publish, via bundle.social. | src/lib/social/bundlesocial.ts:33 |
What is deliberately not on this list
We checked rather than assumed. There is no analytics vendor: no product analytics, no advertising pixel, no session recorder. There is no font CDN: our typefaces are files on our own domain. There is no captcha provider and no embedded chat widget. This is why Carouza has no cookie banner: there is nothing third-party to consent to.
Changes to this list
If we add a sub-processor, this page changes and the date at the top changes with it. Customers with a signed Data Processing Addendum are notified in advance and may object, as set out in our DPA.
Questions about any vendor here, including which transfer mechanism applies to it, go to [TO BE COMPLETED: privacy email address].