img.pro

Subprocessors

Third-party processors that help us deliver the Service under applicable contractual and data-protection terms.

Last updated: September 2026

On this page

Current Subprocessors

The following processors handle personal data on behalf of Moshi Inc. We will update this list before adding or replacing a subprocessor.

Cloudflare, Inc.

  • Purpose: Image storage (R2), structured data (D1), edge compute (Workers), key-value cache (KV), CDN delivery, and background bot protection on sign-in and signup forms (Turnstile).
  • Data: All categories of personal data we process, encrypted at rest and in transit. For bot protection, Turnstile evaluates request signals (IP address, TLS fingerprint, user agent) in the background without setting cross-site cookies; see Cloudflare's Turnstile Privacy Addendum.
  • Region: Global edge network; primary data residency in the United States.
  • Transfer mechanism (EU/UK): EU–U.S. Data Privacy Framework + Standard Contractual Clauses.
  • DPA: Cloudflare Data Processing Addendum (v6.4, effective 3 April 2026).

Amazon Web Services, Inc.

  • Purpose: Transactional email delivery (SES) and automated content-safety classification of uploaded images (Rekognition).
  • Data: Recipient email address and message content for SES; downscaled image bytes for Rekognition (not retained for training).
  • Region: us-east-1 (United States).
  • Transfer mechanism (EU/UK): EU–U.S. Data Privacy Framework + Standard Contractual Clauses.
  • DPA: AWS GDPR DPA + UK GDPR Addendum, auto-applied via the AWS Customer Agreement.

Stripe, Inc.

  • Purpose: Payment processing for img.pro subscriptions and for the plans you buy in Apps built on img.pro; fraud screening; tax computation and collection (Stripe Tax) including EU VAT.
  • Data: Billing name, address, and payment-method data, collected directly by Stripe; we never see card numbers.
  • Region: United States and Ireland.
  • Transfer mechanism (EU/UK): Standard Contractual Clauses.
  • DPA: Stripe Data Processing Agreement (18 November 2025).

PostHog, Inc. (PostHog Cloud EU)

  • Purpose: Product analytics, funnel and retention analysis, heatmaps, browser exception and performance monitoring, session replay, bounded server-side product outcomes, and Stripe-backed subscription/revenue analysis.
  • Data: The custom event stream contains sanitized route templates and referrer origins; validated UTM source, medium, and campaign dimensions; page and interaction activity; device and coarse location information derived from browser requests; sanitized exception frames; performance timing; opaque account, App and storage identifiers; and categorical product outcomes. It excludes arbitrary element attributes, request/response bodies, filenames, captions, authorization data, raw URL queries, search terms, ad-click identifiers, internal numeric IDs, exception messages, account names, and account emails; autocapture text is separately suppressed before event delivery. Session replay follows our PostHog project’s text/input masking setting and may include ordinary visible UI text and non-password input values. Matched media elements, hidden inputs, selected token/identifier-bearing elements, and designated private regions remain blocked client-side. Page, replay-timeline, network, and performance URLs handled by our sanitizer are reduced to query-free route templates or external origins; network request/response headers and bodies are removed in-browser before replay upload; session-replay console and canvas capture are disabled. Separately, the native Stripe source synchronizes selected Subscription, Invoice, payment/charge, Refund, Product, Price, and Customer/billing fields, which may include Stripe object identifiers, billing contact fields, amounts, taxes, plan details, and payment/refund state. Access to those source tables and revenue models is restricted to authorized staff. PostHog may use a browser request IP for coarse GeoIP enrichment, after which our project setting discards the source IP.
  • Region: European Union (PostHog Cloud EU is hosted in Frankfurt, Germany), with limited support and subprocessor access governed by PostHog's DPA.
  • Transfer mechanism (EU/UK): PostHog's Data Processing Agreement, Standard Contractual Clauses, and UK terms where applicable. Those terms have been accepted and archived with our compliance records. In strict or unknown geolocations, browser analytics remains off until the user opts in.
  • DPA and security: PostHog Data Processing Agreement and PostHog Trust Center.

Flodesk (Flodesk, Inc.)

  • Purpose: Lifecycle and product-update email (only with consent where required).
  • Data: Recipient email address, name, and subscription state.
  • Region: United States (and other locations where Flodesk or its sub-processors operate).
  • Transfer mechanism (EU/UK): Standard Contractual Clauses.
  • DPA: Flodesk Data Processing Addendum (version 27 May 2026). Contracting entity is Flodesk, Inc.

Reddit, Inc.

  • Purpose: Consent-controlled browser PageVisit measurement and server-side conversion measurement for paid acquisition (Reddit Pixel and Conversions API).
  • Data: Browser page-visit and standard request data when the pixel is enabled; for server conversions, SHA-256-hashed email (never plaintext), IP address, browser user agent, event metadata, and, when marketing consent permits, Reddit's ad-click identifier if one is present. Server-side matching can use the other supplied signals when no click identifier is available.
  • Region: United States.
  • Transfer mechanism (EU/UK): Standard Contractual Clauses.
  • DPA: Reddit Advertising Data Processing Agreement (effective 7 August 2025), auto-applied via the Reddit Advertising Services Agreement. Reddit's own subprocessor list: Reddit Ads Subprocessors.

Changes

We will update this page when a subprocessor is added or replaced. If you would like to be notified of changes (typical for enterprise customers), email privacy@img.pro.