Subprocessors
A subprocessor is a company we let touch your data on our behalf. This page lists all of them, what each one receives, and where it sits. It is short, and the list of things we deliberately do not use is much longer — which is the point.
The register
| Who | What they do | What they receive | Where | On what basis |
|---|---|---|---|---|
| Stripe Payments Europe Ltd | Payments, tax calculation, invoicing, fraud checks | Your email, name, billing address, IP address, what you bought and the amount. No health data, no biometric data, no report content | Ireland, with onward processing by Stripe, Inc. in the United States | EU-US Data Privacy Framework certification, with Standard Contractual Clauses contracted for as a fallback |
| Contracted clinician reviewers | Human review of your analysis before release | Watermarked working copies of your images, your measurements, your intake answers, the outcome of your wellbeing screen | Named individuals, in the EU and elsewhere | An individual data-processing contract each, with confidentiality, device requirements, a prohibition on local storage, and Standard Contractual Clauses where the person is outside the EEA |
| Professional advisers | Legal, accounting and audit | Business records. Personal data only where genuinely necessary | France | Professional obligations and engagement letters |
That is the whole register. There is no fourth row.
What we do not use
This list is longer than the one above, and that is deliberate. "We host it ourselves" is a claim that only becomes credible when it is specific.
| Category | What we use |
|---|---|
| Cloud object storage | None. Self-hosted, on machines we control |
| Managed database | None. Self-hosted PostgreSQL |
| Third-party analytics | None. First-party events, in our own database, never leaving it |
| Advertising pixels, conversion APIs, custom-audience uploads | None, on any page |
| Session replay and heatmaps | None. Categorically incompatible with this kind of data |
| Third-party live chat | None. Care messaging is ours |
| Email delivery providers | None. Our own mail server |
| Hosted error tracking | None. Self-hosted |
| Content delivery network | Not in front of anything of yours. Marketing images only, and those contain no personal data |
| Third-party form tools | None. Our forms are ours |
| Hosted AI and vision APIs | None. No photograph, measurement, intake answer or report content is ever sent to a third-party model. Every stage of inference runs on hardware we own, on a network with no route out |
| Data brokers, enrichment, identity resolution | None |
The last-but-one row is the one we would defend hardest. Calling a hosted vision model would be operationally convenient and it would put the most sensitive asset in the business outside our control. It is prevented by a network configuration rather than by a policy: the machines that run the analysis have no outbound internet route, and a build fails if one appears.
Before we add anyone
We announce a new subprocessor here 30 days before they begin processing anything. During those 30 days you can object. If we cannot resolve your objection, you may cancel and we will refund the unused part of your year — that is a term of the Terms of Service, section 9.9, not a courtesy.
There is no mailing list to join for this. The commitment is that the notice appears here, dated, before the change happens.
Open items
We would rather publish this page with its gaps named than wait until it reads better.
- The Stripe data processing agreement, with Standard Contractual Clauses and a recorded transfer impact assessment, is not yet signed. The row above states what we contract for, not what is concluded. It will be in place before we take a payment.
- No alternative dispute resolution provider has been appointed. See section 10.3 of the Terms of Service.
- Reviewer recruitment is not complete, so the second row of the register describes a category of processor rather than a list of named people. When reviewers exist, their names and credentials are published on /about-us, because a reviewer whose name appears on your report should be verifiable.
Changes to this page are dated and kept in the version history.
Questions: dpo@beautyprivilege.com.