Subprocessors and data processing agreement
This page lists the service providers that process personal data on our behalf when delivering NeuroShot (Article 28(2) and (4) GDPR). It exists as its own page because business customers regularly ask for it during security reviews.
Subprocessors
These services are required to operate NeuroShot and are used regardless of consent.
| Service | Purpose | Processing location |
|---|---|---|
| Supabase | Database and authentication | EU |
| Cloudflare R2 | Image storage | EU |
| Google Cloud / Vertex AI | AI image generation. Prompts and uploaded reference images are processed to generate images, not for training. | EU |
| Firebase Hosting (Google LLC) | Web hosting, delivery of the application | USA – third country, safeguarded by the EU-US Data Privacy Framework |
| Email delivery (SMTP) | Support and confirmation emails, such as confirming receipt of a cancellation | Provider and location on request |
| Stripe | Payment processing. NeuroShot stores no card details. | Contracting entity and location on request |
Only after consent
These services load only once you have agreed in the cookie banner. Without consent, no data is transmitted.
| Service | Purpose | Processing location |
|---|---|---|
| Google Analytics (Google Ireland Limited) | Audience measurement. Your IP address is truncated within the EU/EEA before transmission. | EU, transfer to the USA possible |
| Meta Pixel (Meta Platforms Ireland Limited) | Audience measurement | Ireland |
Requesting a data processing agreement
If you use NeuroShot commercially and process third-party personal data in doing so, you need a data processing agreement under Article 28(3) GDPR. We provide one on request.
Write to us with your company name, address and the person authorised to sign. We deliberately do not publish a ready-made contract here, because a DPA should match your specific use case.
info@kaymaikfotografie.deChanges
Changes to this list, in particular adding a new subprocessor, are published on this page. Existing contract customers are additionally informed in advance so that the right to object under Article 28(2) GDPR can be exercised.