Subprocessors
Last updated 24 August 2026Byte Shift Ltd, company number 13244292
1. The list
| Company | What it does for us | What it can see | Where |
|---|---|---|---|
| BytePlus (ByteDance) | Image generation and product analysis | The photographs you upload, the product crops taken from them, and the prompts describing your shoot | Singapore, with processing in the region the endpoint serves |
| Anthropic | Assistive text drafting inside the studio, and an alternative product analyser | Product photographs and their descriptions when that analyser is selected. Not used for customer photographs in the default configuration | United States |
| Google (standby) | Refining the bounding boxes around detected products | Product photographs, only when the alternative analyser above is in use | United States |
| Features and Labels (fal.ai) (standby) | Standby image generation provider | The same references and prompts as the primary generator, if a failover occurs | United States |
| Cloudflare | Object storage for images, and network protection | Your uploaded and generated image files | European Union, with a global network |
| Hetzner | Application, worker and database hosting | Account records, projects, product descriptions and credit ledgers, and everything in transit through the application including images while they are processed | Germany |
A provider marked standby is contracted and configured but is not receiving customer data in the current configuration. We name them because a failover would engage them, and you should not learn that from an incident report.
Payment processing will be added to this list when card payments go live. Card details will be handled entirely by the payment provider and will never reach our servers.
2. What they may and may not do
Each of these companies is engaged under a written contract that limits them to processing on our instructions, requires appropriate security, and restricts onward transfers. For the AI providers we use business or enterprise terms under which submitted content is not used to train their models. Where a provider is outside the United Kingdom, transfers rely on UK adequacy regulations or on the International Data Transfer Agreement or UK Addendum, as described in our privacy policy.
3. Changes to this list
We will publish a change here and notify business customers who have asked to be told at least 15 days before a new subprocessor starts processing customer data. If you object on reasonable data protection grounds, tell us within 10 days of the notice and we will work with you to find an alternative. If we cannot, you may terminate and we will refund unused credits.
To be added to the notification list, or to ask anything about a provider here, write to support@fashionstudioapp.com.
Questions about this document: support@fashionstudioapp.com. Byte Shift Ltd is registered in England and Wales.