Subprocessors

Third-party processors that help us deliver the Service. Each is bound by a Data Processing Agreement.

Last updated: May 2026

Current Subprocessors

The following processors handle personal data on behalf of Moshi Inc. We will update this list before adding or replacing a subprocessor.

Cloudflare, Inc.

  • Purpose: Image storage (R2), structured data (D1), edge compute (Workers), key-value cache (KV), CDN delivery.
  • Data: All categories of personal data we process — encrypted at rest and in transit.
  • Region: Global edge network; primary data residency in the United States.
  • Transfer mechanism (EU/UK): EU–U.S. Data Privacy Framework + Standard Contractual Clauses.

Amazon Web Services, Inc.

  • Purpose: Transactional email delivery (SES) and automated content-safety classification of uploaded images (Rekognition).
  • Data: Recipient email address and message content for SES; downscaled image bytes for Rekognition (not retained for training).
  • Region: us-east-1 (United States).
  • Transfer mechanism (EU/UK): EU–U.S. Data Privacy Framework + Standard Contractual Clauses.

Stripe, Inc.

  • Purpose: Payment processing for paid subscriptions; fraud screening; tax calculation (Stripe Tax).
  • Data: Billing name, address, and payment-method data — collected directly by Stripe; we never see card numbers.
  • Region: United States and Ireland.
  • Transfer mechanism (EU/UK): Standard Contractual Clauses.

Plausible Insights OÜ

  • Purpose: Privacy-respecting, cookieless web analytics.
  • Data: Aggregated, non-identifying event data; no cookies, no cross-site tracking.
  • Region: European Union (Estonia / Germany).
  • Transfer mechanism (EU/UK): EU-based; no third-country transfer needed.

Resend.com, Inc.

  • Purpose: Lifecycle and product-update email (only with consent where required).
  • Data: Recipient email address, name, and audience subscription state.
  • Region: United States.
  • Transfer mechanism (EU/UK): Standard Contractual Clauses.

Reddit, Inc.

  • Purpose: Server-side conversion measurement for paid acquisition (Reddit Conversions API).
  • Data: SHA-256-hashed email and event metadata for users who arrived via Reddit ads.
  • Region: United States.
  • Transfer mechanism (EU/UK): Standard Contractual Clauses.

Changes

We will update this page when a subprocessor is added or replaced. If you would like to be notified of changes (typical for enterprise customers), email privacy@img.pro.