Skip to content

Sub-processors

Draft pending legal review

This text is a draft a lawyer still has to review: it is not yet the legal text in force and may change before it takes effect.

Entity details pending

Some details of the entity responsible for Drop are still missing. Where it says «To be confirmed», the detail will be published as soon as it is decided: none is made up.

Version 0.1 · updated on November 5, 2026

To provide the service, Drop relies on these providers, which process personal data on its behalf under a contract that binds them to protect it as Drop would. For the data of an artist's clients they are the artist's sub-processors, as the processing agreement says.

Providers

  • Supabase

    Company
    Supabase, Inc.
    What for
    Database, sign-in, image storage and server functions: where all of Drop's data lives.
    What data
    All of it: accounts, profiles, conversations, images, projects, bookings and reviews.
    Where
    European Union (Paris, France)
    Safeguard
    Hosted in the EU; standard contractual clauses for support access from outside the EU.

  • Vercel

    Company
    Vercel Inc.
    What for
    Hosting of the website and its functions (in Paris) and the network that delivers its pages.
    What data
    What travels with each visit: IP address, pages requested and, when signed in, the data the page shows.
    Where
    European Union (Paris, France) and a worldwide delivery network
    Safeguard
    EU-US Data Privacy Framework and standard contractual clauses.

  • Vercel AI Gateway

    Company
    Vercel Inc.
    What for
    Routes each request for the agent's replies, the summaries and the consent review the artist asks for and the abuse detector to the model's provider (OpenAI or Anthropic), and measures its cost.
    What data
    The conversation and the context each request needs, the clauses and aftercare of the artist's consent when they ask for a review, and the artist's identifier.
    Where
    United States
    Safeguard
    EU-US Data Privacy Framework and standard contractual clauses.

  • OpenAI

    Company
    OpenAI
    What for
    The model (GPT-6 Luna) that writes the agent's replies, the summaries the artist asks for and the ones the agent uses as memory of long conversations, and the abuse detector that reviews the messages, all only with the artist's AI permission; the AI review of the consent, when the artist asks for it, which reads only their own text; and, when it is on, the moderation of chat images, a safety measure that does not depend on the AI permission.
    What data
    The conversation and its context; the client's new messages; the clauses and aftercare of the artist's consent, when they ask for a review; the photos clients send to the chat, without metadata (moderation sends them directly, not through Vercel AI Gateway).
    Where
    United States
    Safeguard
    Standard contractual clauses.

  • Anthropic

    Company
    Anthropic, PBC
    What for
    The Claude models that answer in place of the agent when OpenAI's fails and review new messages for abuse when OpenAI's detector fails, only with the artist's AI permission.
    What data
    The conversation and its context; the client's new messages.
    Where
    United States
    Safeguard
    Standard contractual clauses.

  • Resend

    Company
    Resend, Inc.
    What for
    Sending the emails: access codes, booking notices, reminders and billing.
    What data
    Email address, name and what each email says (for example, the day of an appointment).
    Where
    To be confirmed
    Safeguard
    To be confirmed

  • Stripe

    Company
    Stripe Payments Europe, Limited
    What for
    Charging artists' subscriptions and top-ups, VAT calculation (Stripe Tax) and invoices. Not deposits: the artist charges them in their own Stripe account, under their own agreement, and Drop only opens the payment and records it.
    What data
    The artist's: name or company name, address, tax ID if given, email and card (kept by Stripe, never by Drop).
    Where
    European Union (Ireland) and United States
    Safeguard
    EU-US Data Privacy Framework and standard contractual clauses.

  • Sentry

    Company
    Functional Software, Inc.
    What for
    Error and performance tracking of the website, the app and the server functions.
    What data
    Technical details of the failure and internal identifiers; conversation texts and email addresses are removed before sending it. Sentry deletes it after 90 days at most.
    Where
    European Union (Frankfurt, Germany)
    Safeguard
    To be confirmed

  • PostHog

    Company
    PostHog, Inc.
    What for
    Product usage statistics (identifiers and codes only) and, if the visitor accepts it, the website's analytics.
    What data
    The artist's and the event's identifiers, deleted in PostHog when the account is deleted; on the website, the page viewed, the language and an anonymous browser identifier.
    Where
    European Union
    Safeguard
    Hosted in the EU; standard contractual clauses for access from outside the EU.

  • Cloudflare Turnstile

    Company
    Cloudflare, Inc.
    What for
    Checks that whoever asks for an access code or uses the account forms is a person and not a program.
    What data
    Technical browser data and the IP address, during the check.
    Where
    Worldwide network
    Safeguard
    EU-US Data Privacy Framework and standard contractual clauses.

  • Apple

    Company
    Apple Inc.
    What for
    Push notifications to the artist's iPhone (APNs), Sign in with Apple and address completion for their locations (Apple Maps).
    What data
    In a push, the client's name and the day of the appointment; at sign-in, the artist's email; the address the artist types.
    Where
    United States and worldwide network
    Safeguard
    EU-US Data Privacy Framework and standard contractual clauses.

  • Google

    Company
    Google LLC
    What for
    Sign in with Google for artists. Drop does not connect to Google Calendar: the schedule is shared through a calendar link.
    What data
    Email address and name of the artist's Google account.
    Where
    United States and worldwide network
    Safeguard
    EU-US Data Privacy Framework and standard contractual clauses.

Data outside the European Union

Drop's data is stored in the European Union. The providers marked in the United States process it there, with the safeguards shown: the European Commission's standard contractual clauses and, where the provider is certified, the EU-US Data Privacy Framework. More detail in the privacy policy.

Changes to the list

Before adding or replacing a provider we will update this page and tell artists by email at least 30 days before. An artist who objects on reasonable grounds may leave without penalty if we find no other solution. For any question, write to legal@drop.ink.

Entity details

Trade name
Drop
Owner
Pol Pages Luque
Legal form
Sole trader (autónomo)
Tax ID
54165473J
Registered address
Avinguda de Catalunya 101, 08184 Palau-solità i Plegamans (Barcelona)
Contact email
contact@drop.ink
Privacy email
legal@drop.ink
In force since
[To be confirmed: In force since]
Back to Drop