Last updated: October 30, 2026
Operator: PassportCraft LLC, 418 Broadway, Ste N, Albany, NY 12207, USA
Contact: privacy@passportcraft.com
Sub-processors
PassportCraft LLC engages the third-party service providers below ("sub-processors") to help deliver the PassportCraft platform. Each is bound by a written data protection agreement with obligations no less protective than our Data Processing Agreement, and we remain responsible to you for their performance.
Before engaging any sub-processor we conduct due diligence on its security and data-protection practices, and we review our sub-processors periodically (see Annex B.10 of our Data Processing Agreement).
This page is the authoritative, current list. It is referenced by our Terms of Service, Privacy Policy, and Data Processing Agreement (Annex C).
Recent changes
This block records additions, removals, and material changes to the list, with effective dates, so that returning readers can see what changed without re-reviewing the whole page.
- 2026-10-28 (UTC) — Extended the existing Amazon Web Services, Inc. backup service to database recovery copies. Manual copies have been created and tested. The daily database schedule was enabled on 29 October 2026 (UTC). No provider was added or replaced.
- 2026-10-23 — Moved Vercel Inc.'s application servers from the United States (Washington, D.C. region) to the EU (Dublin, Ireland). Server logs stay with Vercel in the United States. No sub-processor was added or removed, and the data Vercel processes is unchanged.
- 2026-10-12 — Added Amazon Web Services, Inc. to keep a backup copy of uploaded files. The copy is stored in the EU (Frankfurt, Germany). Customers can object as described in Article 6 of our Data Processing Agreement.
- 2026-10-09 — Added Functional Software, Inc. (Sentry) for error monitoring. Error data is stored in the EU (Frankfurt, Germany). Customers can object as described in Article 6 of our Data Processing Agreement.
- 2026-07-01 — Corrected the Stripe entry to the entity we actually contract with: Stripe, LLC (United States), the entity certified under the EU-US Data Privacy Framework. The entry previously read "Stripe Inc.", USA/Ireland. No change to the service provided or the data processed.
- 2026-07-01 — Added a note on external services that receive no personal data (Ecobalyse) below the table, for completeness. No sub-processor was added: Ecobalyse receives no personal data.
- 2026-06-19 — Added an "Applies to" column distinguishing Core from Conditional sub-processors and a "Recent changes" block. No sub-processors were added or removed.
| Sub-processor | Applies to | Purpose | Data processed | Location | Transfer safeguard |
|---|---|---|---|---|---|
| Vercel Inc. | Core (all customers) | Platform hosting, content delivery, edge/serverless compute | Platform data in transit, edge cache, server logs, and IP addresses (durable customer and DPP data is stored at rest by Supabase in the EU) | USA (company and main processing, including server logs); application servers in the EU (Dublin, Ireland); global edge network | EU-US Data Privacy Framework (DPF); Standard Contractual Clauses (SCCs) |
| Supabase Inc. | Core (all customers) | Database hosting, authentication, file storage | Account data, product/DPP data, supplier data, authentication tokens, uploaded files | USA (company); customer data hosted in the EU (Ireland, AWS eu-west-1) | Data stored in the EU; SCCs for company access |
| Amazon Web Services, Inc. | Core (all customers), from 2026-10-12 | Backup storage for uploaded files and database recovery copies | Uploaded files and their names; account, workspace and passport data, sign-in account data including password hashes, file metadata and retained security records as described below | USA (company); backup data hosted in the EU (Frankfurt, Germany, AWS eu-central-1) | EU-US DPF; SCCs |
| Stripe, LLC | Core (all paying customers) | Payment processing and subscription management (PCI DSS Level 1) | Billing contact details, payment-method metadata, transaction records | USA | EU-US DPF (Stripe, LLC is certified); SCCs |
| Resend Inc. | Core (all customers) | Transactional and notification email delivery | Names and email addresses of recipients, email content | USA | Standard Contractual Clauses (SCCs) |
| Functional Software, Inc. (Sentry) | Core (all customers), from 2026-10-09 | Error monitoring: records errors in the platform so that we can find and fix them | Error reports: the error message and the place in our code where it occurred, the page address, browser and device type, and an internal account ID when the user is signed in. Each report also lists the pages visited and the requests sent to our servers just before the error. IP addresses are not stored. Passwords and payment card numbers are removed before storage. | USA (company); error data hosted in the EU (Frankfurt, Germany) | EU-US DPF; SCCs |
| Google LLC | Conditional (analytics only if you consent; sign-in only if you choose it) | Website and product analytics (Google Analytics 4, consent-gated); optional "Sign in with Google" | Pseudonymized usage/device data, interaction events; authentication identifiers for users choosing Google sign-in | USA | EU-US DPF; SCCs |
| OpenAI, L.L.C. | Conditional (only if you use AI features) | AI-assisted content features (sustainability-claim rewriting, care-symbol suggestions) | Text submitted by users to AI features | USA | SCCs; OpenAI does not use data submitted via its API to train its models by default |
| Microsoft Corporation | Conditional (only if you choose Microsoft sign-in) | Optional "Sign in with Microsoft" authentication (Microsoft Entra ID) | Authentication identifiers (email, name) for users choosing Microsoft sign-in | USA / EU | EU-US DPF; SCCs |
The "Applies to" column indicates whether a sub-processor handles every customer's data ("Core") or only processes data when you use a specific feature ("Conditional"). Google Analytics runs only after you accept analytics cookies through our consent banner; if you do not consent, no analytics data is sent.
Where a transfer outside the EEA/UK relies on Standard Contractual Clauses, we assess whether the safeguards provide adequate protection (transfer impact assessment) and apply supplementary measures where appropriate, as set out in Article 7 of our Data Processing Agreement.
Database recovery copies
We keep database recovery copies with our existing backup provider, AWS, in Frankfurt, Germany. They contain account and workspace data, passport and product records and history, sign-in account data including password hashes, and file metadata. Uploaded file backups already run separately.
Manual database copies have been created and tested. The automatic daily database backup schedule was enabled on 29 October 2026 (UTC).
New copies exclude sign-in sessions, refresh tokens, temporary sign-in records and authentication audit logs. After a recovery, users sign in again. An earlier recovery-test copy made on 28 October 2026 (UTC) still contains sign-in sessions, including IP addresses and browser details. Database copies can also retain IP addresses already held in application security records.
Database copies are encrypted and protected against routine deletion for 30 days, then scheduled for removal; deletion processing can take longer. Older copies remain subject to that schedule even when their records are excluded from newer copies.
Send data-protection questions to privacy@passportcraft.com. Our Privacy Policy describes your options for material changes.
External services that receive no personal data
For completeness, we also disclose external data flows that involve no personal data and therefore no sub-processing:
- Ecobalyse (operated by the French state — ADEME / beta.gouv.fr, at ecobalyse.beta.gouv.fr) — when you use the environmental-impact scoring feature for textile products, the platform sends product attributes only: the product category, garment mass, fiber material identifiers and shares, and country codes. The request is anonymous — it includes no name, email address, IP-based identifier, account, or organization identifier. Because Ecobalyse receives no personal data, it is not a sub-processor, and the notification and objection procedures below do not apply to it.
Changes and notifications
We will give at least 30 days' advance notice before adding or replacing a sub-processor, so that customers may object on reasonable data-protection grounds as described in Article 6 of our Data Processing Agreement.
If a customer does not object in writing within the 30-day notice period, the new sub-processor is deemed accepted. If a customer objects on reasonable data-protection grounds, the objection is handled as set out in Article 6 of our Data Processing Agreement, which may, if the matter remains unresolved, allow the customer to terminate and receive a refund of prepaid fees.
There are two ways to track changes to this list:
- Email notifications. Email privacy@passportcraft.com with the subject line "Sub-processor updates" and we will add you to our notification list. Subscribers receive the advance notice described above.
- Watch the source. This list is maintained in our public version-controlled repository at a stable URL, and the "Recent changes" block above is updated whenever the list changes. Customers who prefer to monitor the page programmatically (for example, with a page- or repository-change watcher) can do so without contacting us.
We do not yet offer an automated in-page subscription form; the email notification list above is the channel we maintain.
Prior versions of this list are available on request — email privacy@passportcraft.com — as a complete, dated history is retained in our version-controlled records.