Subprocessors and data processing agreement
This page lists the service providers that process personal data on our behalf when delivering NeuroShot (Article 28(2) and (4) GDPR). It exists as its own page because business customers regularly ask for it during security reviews.
Subprocessors
These services are required to operate NeuroShot and are used regardless of consent.
| Service | Purpose | Processing location |
|---|---|---|
| Supabase | Database and authentication | EU |
| Cloudflare R2 | Image storage | EU |
| Google Cloud / Vertex AI | AI image generation. Prompts and uploaded reference images are processed to generate the result, not for training. | EU – region europe-west4 (Netherlands) |
| Firebase Hosting (Google LLC) | Web hosting, delivery of the application | USA – third country, safeguarded by the EU-US Data Privacy Framework |
| Google account sign-in (Google Ireland Limited) | Optional sign-in via “Sign in with Google”. IP address, browser identifier and the released account data are transmitted. | Ireland; processing in the USA possible, safeguarded by the EU-US Data Privacy Framework |
| Brevo (email delivery) | Sending support, cancellation and system notifications. Email address, name and message content are transmitted. | EU (Brevo, France) – processing in EU data centres |
| Stripe Payments Europe, Ltd. | Payment processing. Email address and user ID are transmitted; card and billing data are collected by Stripe directly from you. NeuroShot stores no card data. | Dublin, Ireland; transfer to Stripe, Inc. (USA) possible, safeguarded by standard contractual clauses and the EU-US Data Privacy Framework |
Only after consent
These services load only once you have agreed in the cookie banner. Without consent, no data is transmitted.
| Service | Purpose | Processing location |
|---|---|---|
| Google Analytics (Google Ireland Limited) | Audience measurement. Your IP address is truncated within the EU/EEA before transmission. | EU, transfer to the USA possible |
| Meta Pixel (Meta Platforms Ireland Limited) | Audience measurement | Ireland |
Requesting a data processing agreement
If you use NeuroShot commercially and process third-party personal data in doing so, you need a data processing agreement under Article 28(3) GDPR. We provide one on request.
Write to us with your company name, address and the person authorised to sign. We deliberately do not publish a ready-made contract here, because a DPA should match your specific use case.
info@kaymaikfotografie.deYour rights in relation to these subprocessors
You exercise your rights to access, rectification, erasure, restriction, data portability and objection (Articles 15 to 21 GDPR) with us as the controller, not with the service providers listed here. We pass your request on to the subprocessors concerned. The competent supervisory authority is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW), Kavalleriestr. 2-4, 40213 Düsseldorf, Germany.
Changes
Changes to this list, in particular adding a new subprocessor, are published on this page. Existing contract customers are additionally informed in advance so that the right to object under Article 28(2) GDPR can be exercised.