Infraestructura

Last updated: October 10, 2026

Operator: PassportCraft LLC, 418 Broadway, Ste N, Albany, NY 12207, USA

We store your data in the European Union, in Ireland. From 12 November 2026, we also store error reports in the European Union, in Germany. The servers that run PassportCraft are in the United States. This page lists each service that stores or runs your data, the law that applies to it, and what we do to protect data held in the European Union from unlawful access by foreign governments. Section 13A(h) of our Terms of Service refers to it.

Where your data is stored and processed

Service	Provider	Location	What it handles
Database, sign-in and file storage	Supabase Inc.	European Union: Ireland (AWS eu-west-1)	Your account, all passport and product data, battery readings, scan statistics and uploaded files
Application servers	Vercel Inc.	United States: Washington, D.C. region	Every request to the app, the API and published passports passes through them. They keep server logs.
Content delivery	Vercel Inc.	Vercel's global network	Pages and files on their way to visitors
Email	Resend Inc.	United States	Names, email addresses and the content of the emails we send
Payments	Stripe, LLC	United States	Billing details and payment records
AI features, only if you use them	OpenAI, L.L.C.	United States	The text you submit to an AI feature
Analytics, only with consent; Google sign-in, only if you choose it	Google LLC	United States	Pseudonymized usage and device data; your name and email address for sign-in
Microsoft sign-in, only if you choose it	Microsoft Corporation	United States and European Union	Your name and email address
Textile environmental scoring, only if you use it	Ecobalyse, operated by the French state	France	Product attributes only, no personal data
Error monitoring, from 12 November 2026	Functional Software, Inc. (Sentry)	European Union: Frankfurt, Germany	Error reports from the app: the error message, the page address, browser and device type, and an internal account ID. Each report also lists the pages visited and the requests sent to our servers just before the error.

Our sub-processor list gives each provider's safeguards for personal data.

Which law applies

PassportCraft LLC is a limited liability company organized under the laws of the State of New York, USA. Each provider above, except Ecobalyse, is a company based in the United States. US law applies to all of them, including laws that can require a company to disclose data it controls, wherever the data is stored. Data stored in Ireland is also subject to EU and Irish law.

How we protect data held in the EU

Technical measures

Your stored data is held in the European Union: in Ireland, and from 12 November 2026 error reports in Germany.
Data is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent), as our Security page describes.
Access is controlled by role. Our staff need multi-factor authentication to reach production systems, and only those who need access have it.

Organizational and contractual measures

If a public authority sends us a legally binding request for your data, personal or not, we do the following, unless the law forbids it:

We tell you promptly. If the law forbids us to tell you, we try to have that lifted, so that we can tell you as much as possible, as soon as possible.
We do not disclose your data unless the law compels us to.
We check whether the request is lawful. If there are reasonable grounds to think it is not, we challenge it, appeal where we can, and ask for its effects to be suspended until a court or competent authority decides.
We disclose only the minimum the request requires, read reasonably.

We keep a record of each request and of our answer, and show it to you on request where the law allows. For personal data, the same commitments are in Article 5.10 of our Data Processing Agreement. This page extends them to data that is not personal.

These commitments are ours. A provider above that receives a request directly answers it under its own policies.