stagify.ai
Subprocessors
This page lists the third parties that process data on Stagify’s behalf in order to run the Service. It is the list referred to by Section 10.1 of our Privacy Policy and by Exhibit A.5 of our Enterprise Master Services Agreement. It exists as its own page so that it can be read, linked, and compared over time without opening a contract.
Each provider is authorized to process personal information only on our instructions and only for the purpose described below. Where required by law, we have data processing agreements in place with obligations consistent with the GDPR, the UK GDPR, and applicable U.S. state privacy laws.
Artificial intelligence
- Google LLC (United States) — Gemini API. Receives the photographs you upload, any reference or furniture images, and your prompt text, in order to produce a staged image. Also receives floor plans and PDFs submitted to the CAD tools. (Privacy Policy)
- OpenAI, L.L.C. (United States) — AI Designer chat, image analysis, and the stored memories that accompany a conversation. Receives your messages, any images attached to them, and images sent for classification. (Privacy Policy)
Neither provider is permitted to use your content to train models, and we do not use it to train our own — see Privacy Policy Section 5.4.
Hosting and storage
- Render Services, Inc. (United States) — application hosting, and the persistent disk that holds our account database and operational logs. (Privacy Policy)
- Cloudflare, Inc. (United States) — object storage (R2) for the images saved in your gallery: the staged render, its thumbnail, and the source photo it was made from. Also the destination for our encrypted database backups. (Privacy Policy)
Payments, email, and monitoring
- Stripe, Inc. (United States) — payment processing and subscription management. Receives your email address and billing details. Card numbers are handled entirely by Stripe and never reach our servers. (Privacy Policy)
- Resend (United States) — transactional and lifecycle email delivery. Receives the recipient’s email address and the message. (Privacy Policy)
- Functional Software, Inc. d/b/a Sentry (United States) — error monitoring. Configured to send no personally identifiable information: no cookies, no authentication headers, and no client IP address. (Privacy Policy)
- ipwho.is — receives the IP address of visitors to our internal administrative console, and returns an approximate city and country for our security log. It is not used on any page a customer visits, and it receives no other data.
Advertising
Google Ads is not a subprocessor. It is a separate third party that receives online identifiers from our public marketing pages for advertising measurement, which is why it is described in Sections 10.2 and 16.3 of the Privacy Policy rather than listed here. It receives no customer content, no account data, and nothing from the product itself. It is not loaded at all for visitors who appear to be in the EEA, the UK, or Switzerland, for visitors whose browser sends a Global Privacy Control signal, or for visitors who have opted out.
International transfers
All of the providers above process data in the United States. Where required, we rely on the Standard Contractual Clauses issued under European Commission Decision 2021/914 (Module Two: controller to processor), the UK International Data Transfer Addendum issued by the ICO, or an applicable adequacy decision.
Changes to this list
We revise the date at the top of this page whenever the list changes. Enterprise customers under our Master Services Agreement receive at least 30 days’ notice before a new subprocessor begins processing their personal data, and may object in writing within 14 days on reasonable data-protection grounds — see Exhibit A.5 of the MSA.
Questions about this list: team@stagify.ai.