Subprocessors
Last updated 20 September 2026Byte Shift Ltd, company number 13244292
1. The list
| Company | What it does for us | What it can see | Where |
|---|---|---|---|
| Google (Gemini) | Reading your uploaded photographs: detecting and describing each product | The photographs you upload, and the product descriptions produced from them | United States |
| BytePlus (ByteDance) | Image generation | The product crops taken from your photographs, our catalogue model references, and the prompts describing your shoot | Singapore, with processing in the region the endpoint serves |
| Anthropic (standby) | Drafting assistive text inside the studio, and an alternative product analyser held in reserve | Product photographs and their descriptions only if that analyser is switched on. Not used for customer photographs in the current configuration | United States |
| Stripe | Payments, subscriptions, invoices and receipts | Your name, email address and billing history. The card details you type into the payment form go to Stripe directly and never reach us | United States and Ireland |
| Google (Analytics) | Visit statistics for the marketing website, only after you accept analytics cookies | The pages you visit on the website, your approximate location and device type; never your account, your photographs or anything inside the application | United States |
| Scaleway | Sending account emails | Your email address and the content of the emails we send you | France |
| Cloudflare | Object storage for images, network protection, the bot check on the contact forms (Turnstile), and cookieless visit counts for the marketing website (Web Analytics) | Your uploaded and generated image files; for the contact forms, your IP address and browser signals, never the message; for the website, aggregate page and referrer counts that identify nobody | European Union, with a global network |
| Hetzner | Application, worker and database hosting | Account records, shoots, product descriptions and credit ledgers, and everything in transit through the application including images while they are processed | Germany |
A provider marked standby is contracted and configured but is not receiving customer data in the current configuration. We name them because a failover would engage them, and you should not learn that from an incident report.
2. What they may and may not do
Each of these companies is engaged under a written contract that limits them to processing on our instructions, requires appropriate security, and restricts onward transfers. For the AI providers we use business or enterprise terms which require that submitted content is not used to train their models; some keep it briefly for abuse detection, as our privacy policy explains. Where a provider is outside the United Kingdom, transfers rely on UK adequacy regulations or on the International Data Transfer Agreement or UK Addendum, as described in our privacy policy.
3. Changes to this list
We will publish a change here and notify business customers who have asked to be told at least 15 days before a new subprocessor starts processing customer data. If you object on reasonable data protection grounds, tell us within 10 days of the notice and we will work with you to find an alternative. If we cannot, you may terminate and we will refund unused credits.
To be added to the notification list, or to ask anything about a provider here, write to support@fashionstudioapp.com.
Questions about this document: support@fashionstudioapp.com. Byte Shift Ltd is registered in England and Wales.