iMeshh Pro

Sub-processors

Version 2026-06-23.1 · Last updated 31 May 2026

Plain-English summary

To run iMeshh Pro we rely on a small number of trusted third-party service providers ("sub-processors") that may process personal data on our behalf. This page lists them and is kept up to date.

Under our Data Processing Agreement we give Studio customers at least 30 days' notice before a new sub-processor starts handling their data, so they can object.

Where a sub-processor is located outside the UK or European Economic Area (EEA), we rely on UK/EU-recognised transfer safeguards — the UK Addendum to the EU Standard Contractual Clauses, the EU Standard Contractual Clauses, and/or the UK Extension to the EU-US Data Privacy Framework where the provider is certified — as described in our Data Processing Agreement. Where we say a service is in a particular region, that reflects the configuration we operate; some regions are being finalised during the beta and this list will be updated to match.

Core infrastructure

Supabase

  • Purpose: user authentication and the primary application database.
  • Personal data: account identifiers, email address, names, and the data you store in the product.
  • Location: EU region (provider: Supabase, Inc., United States).

Cloudflare

  • Purpose: API hosting (Workers), file storage (R2), content delivery, and bot protection (Turnstile).
  • Personal data: data in transit, uploaded files, and IP addresses.
  • Location: file storage (R2) is in the EU; the global edge network is operated by Cloudflare, Inc. (United States).

Vercel

  • Purpose: hosting for our websites and application front-ends, plus first-party website usage analytics.
  • Personal data: page-view and performance data, and IP addresses.
  • Location: Vercel, Inc. (United States), serving EEA traffic from EU regions where configured.

Upstash

  • Purpose: rate-limiting and short-lived caching.
  • Personal data: request identifiers (such as account or studio IDs) used as cache keys.
  • Location: EEA region (Frankfurt) where available.

Fly.io

  • Purpose: on-demand 3D rendering of thumbnails and previews.
  • Personal data: the 3D files submitted for rendering.
  • Location: Fly.io, Inc. (United States).

Backblaze

  • Purpose: off-site, encrypted disaster-recovery backups of the database and uploaded files.
  • Personal data: an encrypted copy of the application database and stored files (which may contain personal data), retained for up to 12 months then permanently deleted.
  • Location: EU region (Amsterdam, EU Central region; provider: Backblaze, Inc., United States).

Payments

Stripe

  • Purpose: payment processing and subscription billing.
  • Personal data: name, email, billing address, VAT number, and payment-card metadata. Full card details are handled by Stripe and are not stored by us.
  • Location: Stripe Payments Europe, Ltd (Ireland) together with Stripe, Inc. (United States).

Email

Resend

  • Purpose: sending transactional and notification emails (sign-in, invoices, alerts).
  • Personal data: recipient name and email address, and the content of those emails.
  • Location: Resend (United States).

Klaviyo

  • Purpose: email-marketing automation and newsletter / offer sign-ups.
  • Personal data: email address and marketing-engagement data.
  • Location: Klaviyo, Inc. (United States).

Brevo

  • Purpose: sending bulk marketing-email campaigns.
  • Personal data: email address.
  • Location: Brevo (Sendinblue SAS), France (EEA).

Analytics (consent-based)

Google Analytics

  • Purpose: understanding website usage — loaded only with your consent.
  • Personal data: pseudonymous usage events and a truncated IP address.
  • Location: Google LLC (United States).

PostHog

  • Purpose: product analytics inside the app — loaded only with your consent.
  • Personal data: a pseudonymous user identifier and usage events (not your email).
  • Location: PostHog, Inc. (United States).

AI features

Anthropic

  • Purpose: automatic tagging and description of marketplace assets.
  • Personal data: product images and metadata submitted for tagging (not your account data).
  • Location: Anthropic, PBC (United States).

RunPod

  • Purpose: AI image generation, where that feature is enabled.
  • Personal data: the images and prompts submitted for generation.
  • Location: RunPod, Inc. (United States).

Legacy store

WordPress / WooCommerce (shop.imeshh.com)

  • Purpose: our legacy store and historical subscriptions, synced into the platform.
  • Personal data: customer email, names, and order history.
  • Location: as operated for shop.imeshh.com.

Questions or change notifications

To ask about our sub-processors, or to be told when this list changes, contact office@imeshh.com. Studio customers receive advance notice of new sub-processors under our Data Processing Agreement.