Subprocessors

Last updated: 9 August 2026

Äng uses the third-party service providers (subprocessors) listed below to provide the Service. Each provider processes personal data only to the extent needed for the stated purpose, under a data processing agreement or equivalent contractual terms — either directly or through the provider that routes our requests.

We update this page when we add, replace, or remove a subprocessor. If you have an active Data Processing Agreement with us and want to be notified of changes, contact us at privacy@ang.studio.

Supabase

  • Purpose: Database, authentication, and file storage
  • Data processed: Account data (email, user ID), boards, images, files, and other user content
  • Location / transfer safeguard: EU

Vercel

  • Purpose: Application hosting, edge network, bot protection (BotID), AI Gateway model routing, and cookie-free web analytics (analytics only after consent)
  • Data processed: Technical request data (IP address, request logs), usage events; prompts and media for models routed through the AI Gateway (not including direct integrations such as fal.ai)
  • Location / transfer safeguard: Global edge network — EU–US Data Privacy Framework / SCCs

Google

  • Purpose: Sign-in (Google OAuth); Gemini / Veo models for image and video generation (via the AI Gateway); automatic visual analysis of library images for AI search; and Vertex AI hosting for board agent chat in some configurations, including Zero Data Retention mode
  • Data processed: Login identifiers; prompts, images, and files you submit or store that are processed by Google models or Vertex-hosted agent requests
  • Location / transfer safeguard: EU/US — EU–US Data Privacy Framework / SCCs

OpenAI

  • Purpose: GPT Image models (via the AI Gateway); realtime voice transcription (only when you use voice input); and board agent chat when the AI Gateway routes it to OpenAI
  • Data processed: Prompts and images for GPT Image jobs; audio snippets and transcripts when you use voice input; conversation text, board context, and any images included in agent requests routed to OpenAI
  • Location / transfer safeguard: US — EU–US Data Privacy Framework / SCCs

Microsoft

  • Purpose: Azure OpenAI hosting — one of the providers the AI Gateway may select for board agent chat. Under strict Zero Data Retention, agent requests are routed only to providers operating under zero-data-retention agreements, and refused if none is available
  • Data processed: Conversation text, board context, and any images included in agent requests routed to Azure OpenAI
  • Location / transfer safeguard: US/EU — EU–US Data Privacy Framework / SCCs

Anthropic

  • Purpose: Board agent chat and related text models in some configurations (via the AI Gateway; in Zero Data Retention mode those requests are hosted on Google Vertex)
  • Data processed: Conversation text, board context, and any images included in agent requests
  • Location / transfer safeguard: US — EU–US Data Privacy Framework / SCCs

ByteDance

  • Purpose: Seedream image and Seedance video models (via the AI Gateway), only when you select those models
  • Data processed: Prompts, images, and related inputs for those jobs
  • Location / transfer safeguard: US/global — SCCs where applicable

fal.ai

  • Purpose: 3D model generation via a direct API integration (only when you use image-to-3D)
  • Data processed: Images you submit for 3D generation
  • Location / transfer safeguard: US — SCCs

Stripe

  • Purpose: Payment processing for subscriptions and credit top-ups (when paid features are used)
  • Data processed: Billing contact details, transaction metadata; card data is handled by Stripe, not stored by us
  • Location / transfer safeguard: US/EU — EU–US Data Privacy Framework / SCCs

Cloudflare

  • Purpose: Turnstile bot protection on public signup (when captcha is enabled)
  • Data processed: Technical challenge data and IP address during verification
  • Location / transfer safeguard: Global edge network — EU–US Data Privacy Framework / SCCs

Sentry

  • Purpose: Error monitoring and crash reporting
  • Data processed: User ID, email, device and error context (replays masked, PII scrubbed)
  • Location / transfer safeguard: EU (Frankfurt)

PostHog

  • Purpose: Product analytics (only after you consent to analytics)
  • Data processed: User ID (UUID only — never email or name), feature-usage events
  • Location / transfer safeguard: EU (Frankfurt)

Upstash

  • Purpose: Rate limiting (and legacy job-queue fallback when Supabase job storage is unavailable)
  • Data processed: User identifiers, request counters, transient job metadata
  • Location / transfer safeguard: Per deployment region — SCCs where applicable

Resend

  • Purpose: Transactional email (sign-in links, invites, lifecycle messages)
  • Data processed: Email address, message content and delivery metadata
  • Location / transfer safeguard: US — EU–US Data Privacy Framework / SCCs

Notion

  • Purpose: Internal management of in-app feedback (only when you submit feedback)
  • Data processed: Feedback message, your email address
  • Location / transfer safeguard: US — EU–US Data Privacy Framework / SCCs

Content delivery (no user content)

Some on-device features (such as background removal) download machine-learning model files from the jsDelivr and Hugging Face content delivery networks. Your browser's IP address is visible to these CDNs when fetching the files, but no user content or account data is sent to them.

See our Privacy Policy for how we handle personal data, our Data Processing Agreement for business customers, and our Cookie Policy for cookies and similar technologies.

← Back to sign in