Snapshot 36043
Normalized text
Scripts and page chrome removed; this is what change detection compares.
How this list works The list is categorical. Apiway may add, remove, substitute, or combine providers in any category at any time, prospectively, subject to maintaining contractual obligations consistent with the Privacy Policy. References to a specific named provider are illustrative and operational, not contractual. See Privacy Policy §5N.3 and Terms of Use §3A.9 for the binding framework. The Privacy Policy distinguishes Publicly Published Creator Content (§5A.1 — marketplace listings, public storefront content, Instagram posts auto-imported from a connected creator account) from Private Content (§5A.2 — brand product uploads for own generation, account-internal assets, drafts, generation inputs not published). The two categories are routed to different subprocessors and used for different purposes; the list below identifies which. Current categorical list Cloud database & application hosting Provider(s) Supabase, Inc. Processed data Account data, marketplace metadata, generation jobs, agent events, ledger, all relational records. Location European Union (eu-central-1) Transfer mechanism Intra-EU; no cross-border transfer. Object storage (image bytes, generated outputs) Provider(s) Amazon Web Services, Inc. (AWS S3, bucket apiwayimages) Processed data Uploaded reference photos, brand product photos, generated AI outputs, marketplace reference frames. Location European Union (eu-north-1) Transfer mechanism Intra-EU; no cross-border transfer for storage. AWS DPA + SCCs apply where Apiway accesses from US. Compute infrastructure (generation worker) Provider(s) Dedicated bare-metal server (Hetzner, single-tenant) Processed data Image bytes during generation processing (transient). No persistent storage beyond the job lifetime. Location Germany Transfer mechanism Intra-EU. Generative AI providers (image generation, vision analysis, text) Provider(s) Google LLC (Gemini, Imagen). Apiway may substitute equivalent or successor providers (e.g., OpenAI, Anthropic, Stability AI, Black Forest Labs) at its discretion under PP §5N.3 and ToS §3A.9. Processed data AI Inputs (uploaded photos, prompts, references) and AI Output. Where the provider offers a no-training tier and the User has not contributed Publicly Published Creator Content under PP §5C.4, Apiway configures the request on that tier. Location United States and other regions depending on provider routing. Transfer mechanism EU SCCs (Decision 2021/914) with applicable addenda. UK IDTA and Swiss-equivalent safeguards where required. Payment processing Provider(s) Stripe, Inc. Processed data Billing details, subscription status, payment events. Payment card data is processed directly by Stripe under its own privacy notice and is not retained by Apiway. Location United States. Transfer mechanism EU SCCs (Decision 2021/914). Stripe's own data-protection arrangements apply. Authentication & email transactional Provider(s) Resend, Inc. (transactional email); SMTP failover. Processed data Account email, password-reset tokens, transactional message content (sign-in codes, generation-completion notices, policy-update notifications). Location United States. Transfer mechanism EU SCCs. Cross-platform distribution (Apiway-operated accounts on third-party platforms) Provider(s) Pinterest, Inc. (Apiway-operated Pinterest Business account, currently active). Meta Platforms, Inc. (Instagram, Facebook), Google LLC (YouTube), TikTok Ltd., X Corp., LinkedIn Corp., and equivalent platforms may be activated under PP §5C.3 and §5N.3 without further notice. Content distributed under §5C.3 is Publicly Published Creator Content only. Processed data Public listing images (resized for the destination platform), title, caption, link back to the originating Creator's storefront. No Private Content as defined in PP §5A.2. Location United States and global per destination platform. Transfer mechanism Destination platforms' own terms apply once content is republished there. Each platform is itself a controller for content on its platform. Instagram automated import (Meta Graph API) Provider(s) Meta Platforms, Inc. Processed data Read-only access to the Creator's own Instagram media on the Creator's authorization. Used to retrieve newly published Instagram posts for ingestion as Publicly Published Creator Content under PP §5B.2. Location United States. Transfer mechanism Meta API; Meta is itself a controller for the Creator's IG account. Brand e-commerce integration Provider(s) Shopify Inc. Processed data Read-only product metadata (titles, descriptions, images, variants, inventory) from connected stores under the Creator's authorization. Used to populate the Brand Products surface and, where the User opts in, to power AI generation against product images. Location Canada and United States. Transfer mechanism EU SCCs where applicable. Phone / SMS verification (where enabled) Provider(s) Twilio Inc. Processed data Phone number, one-time verification codes (transient). Location United States. Transfer mechanism EU SCCs. Background-removal ONNX runtime (client-side CDN) Provider(s) jsDelivr (Prospect One sp. z o.o.) — public CDN delivering @imgly/background-removal. Processed data Client-side: image bytes that the User uploads to the in-browser background-removal tool never leave the User's browser; only the model weights are fetched from the CDN. No User content is transmitted to the CDN provider. Location Global CDN. Transfer mechanism No User Personal Data transferred. Search & AI-engine discovery (no contractual processing) Provider(s) Search engines (Google Search, Bing, DuckDuckGo, Yandex, Baidu), AI-engine crawlers (OpenAI, Anthropic, Perplexity, Google Gemini retrieval, Apple Intelligence), and similar. Processed data Public surfaces of the Service (storefronts, marketplace listings, blog, docs, sitemap, JSON feeds, llms.txt, ai.txt). These crawlers operate under their own terms; Apiway does not control them and cannot revoke their copies or caches once made (see PP §5E.3 and §5N.5(c)). Location Global. Transfer mechanism None — public-internet crawl. Changes; how to be notified Apiway publishes material additions or replacements on this page and in the public changelog. Where mandatory applicable law requires individual notice (e.g., to an EEA controller customer under a data-processing agreement), Apiway notifies the affected counterparty by email to the address on file no fewer than thirty (30) calendar days before the change takes effect, subject to the objection mechanism in the applicable agreement. Inquiries: [email protected] — please include the subject line “Subprocessor inquiry” so the message is routed to the data-protection desk.