Drawoble · Legal
Sub-processors
These are the service providers that process personal data on Drawoble's behalf. The list is the live one — a vendor appears here only if it is actually in use today.
| Vendor | Purpose | Country | DPA | Transfer safeguard | Last updated |
|---|---|---|---|---|---|
| Supabase | Authentication, application database, and private file storage for projects, drawings, embedded images and generated exports | United States (vendor); data stored in the European Union, Frankfurt | supabase.com/legal/dpa | Standard Contractual Clauses, Module 2 | 2026-07-23 |
| Cloudflare | DNS and TLS, edge delivery and protection, bot-detection challenge on the sign-in screen, and routing of inbound mail sent to our public addresses | United States (global edge network) | cloudflare.com/cloudflare-customer-dpa | Standard Contractual Clauses, Modules 2 and 3 | 2026-07-23 |
| Resend | Delivery of transactional email — the one-time sign-in code and account, security or legal notices. No marketing email is sent. | United States (vendor); sending region European Union, Ireland | resend.com/legal/dpa | Standard Contractual Clauses, Module 2 | 2026-07-23 |
| Sentry | Error and performance monitoring, live since 24 July 2026. Receives crash reports and aggregate editor-performance samples. Neither carries an account identifier, an email address, or any drawing content; the vendor receives the originating IP address of the report. | United States | sentry.io/legal/dpa | Standard Contractual Clauses, Module 2 | 2026-07-26 |
| Hetzner Online | Server hosting for the application containers and the operational tooling that runs alongside them | Germany (European Union) | hetzner.com/AV/DPA_en.pdf | Processing within the EEA — no transfer safeguard required | 2026-07-23 |
| Proton | The mailbox that receives support, billing, legal and privacy correspondence sent to our public addresses | Switzerland (recognised as providing adequate protection) | proton.me/legal/dpa | Adequacy decision | 2026-07-23 |
Notes on this list
Uptime monitoring. An external monitoring service checks a public health endpoint that returns only a build identifier and a version string. It receives no personal data and therefore is not a processor of personal data, so it is not listed above.
Status page. Our public service-status page at status.drawoble.com is hosted by that same monitoring service on its own infrastructure, so that it stays reachable when ours is not. Opening it works like opening any other website: the provider sees the request, including the originating IP address. It holds no account data and no drawings, and nothing from a Drawoble account is sent to it.
Deployment tooling. The tool that builds and deploys the application is self-hosted on the Hetzner servers listed above. It is software we run, not a separate vendor with access to your data.
Not in use. Drawoble currently operates no analytics platform, no advertising vendor, no payment processor, no customer-support ticketing vendor and no AI/LLM provider. If any of those are introduced they will be added here and announced first, as described below.
Changes to this list
Adding or replacing a processor is a material change to the Privacy Policy. We publish it in the change history and notify affected users by email at least 30 days before the change takes effect, so there is time to object or to close an account before the new processor begins handling data.
Questions about this list, or about a specific vendor's terms, go to privacy@drawoble.com.
