Subprocessor Register
Version: 1.1 Effective: 21 October 2026
Published by: Innova.uno Sp. z o.o., Byslawska 84, 04-993 Warsaw, Poland, KRS 0000417704, NIP PL5213629718, REGON 146081689. BoothApps.ai is this company's product and brand.
Contact for questions about this register, for data subject requests and for copies of transfer safeguards: support@boothapps.ai
Direct address of this register: https://boothapps.ai/legal/subprocessors (public, no login required).
1. What this register is and how to use it
1.1 Scope
This register lists every third party that processes personal data for BoothApps.ai, together with what each one does, what data it touches, where it processes, on what basis data reaches it outside the European Economic Area, the state of our contract with it, its position on the use of what we send to train models, and how long it keeps data on its own systems.
How to read the model-training statement. Our standard when we select a provider is a contractual prohibition on training, and where a provider offers a contractual or account-level control we use it. That is a selection standard, not a claim about every provider. The Contractual status column therefore carries a Model training statement for each provider in its own terms. Where nothing is contracted, the statement says so plainly instead of leaving the question open.
It covers three kinds of relationship, and it says which one applies in each table:
- Sub-processors of Guest Data (Table A), engaged under Article 28(4) GDPR to help us perform the services we provide to our Customers.
- Processors of Customer Account Data (Table B), engaged under Article 28(1) GDPR to help us run our own business.
- Independent controllers (Table C), which decide for themselves how they use the data they receive and are not our processors at all.
1.2 The two data domains
Guest Data is everything a Workflow handles about an event guest: the booth photo, the survey answers, the first name, the phone number or email address used to deliver the result, the generation prompts, and the AI-generated images, reports and videos. For Guest Data the Customer (the photo booth or event company running the booth) is the controller and BoothApps is the processor. The providers in Table A are therefore sub-processors, engaged under the general authorization in our Data Processing Agreement.
Customer Account Data is everything about the Customer and the people who use its account: registration and login data, profile and contact details, purchases and billing identifiers, usage counters, support correspondence, website analytics and security telemetry. For this domain BoothApps is the controller and the providers in Table B are our processors.
Several providers appear in both tables because they serve both domains with different data. Where the data set differs, the row says so.
1.3 Why the page is called "subprocessors"
The address /legal/subprocessors is the one our Terms, our Data Processing Agreement and our Privacy Policy link to, and changing it would break links in agreements that are already in force. The name reflects the largest group in the register, not every entry in it: some entries are our own processors and one is an independent controller. The role stated for each table is authoritative.
1.4 Status of this register
- This register forms part of the Data Processing Agreement and the Privacy Policy by reference. Those documents describe categories of recipients and link here; they never copy the vendor list, so a vendor change cannot leave a stale copy behind in a document already in force.
- It is public and available without a login.
- It is versioned and dated. The change log in section 7 records what changed and when.
- Earlier versions are archived. The full editorial history of this page is kept in our version control system, and a copy of any earlier version is available on request at support@boothapps.ai.
- It describes the state of the live service. Providers that are configured but disabled, and providers kept only for a legacy component that no purchasable Workflow uses, receive no data and are not listed as processors. They are described instead in section 5, so that nothing is hidden by omission.
1.5 How we announce changes
- New or replaced sub-processors of Guest Data are announced at least 30 days before they process any Guest Data, by updating this page (new row, new version, new date) and by email to account holders.
- The Customer may object in writing during that period. If we cannot offer a reasonable alternative, the Customer may terminate the affected purchases and receives a pro rata refund for unused Transformations. The full mechanism is set out in the Data Processing Agreement.
- Emergency replacements made in response to a security incident or a provider failure may take effect immediately, with notice as soon as we can give it.
- A material change is published before the new processing starts. Data collected before a change is not affected retroactively, and a new provider does not receive data collected before it was added.
- Changes to processors of Customer Account Data (Table B) and to the independent controllers (Table C) are published here with the same version bump, without the 30-day sub-processor notice, which applies to Guest Data.
1.6 Transfers outside the EEA and copies of safeguards
Where a row names a region outside the European Economic Area, the transfer mechanism column states the basis we rely on. Where that basis is the European Commission's standard contractual clauses, the model text is published by the Commission in Implementing Decision (EU) 2021/914, and a copy of the clauses as applied to a specific provider can be obtained by writing to support@boothapps.ai. Where a provider has not given us Article 28 terms in writing, the row says so plainly rather than implying a safeguard we do not hold.
Innova.uno Sp. z o.o. is established in Poland, inside the EEA, so a Customer sending Guest Data to us is not making a restricted transfer. Onward transfers to the providers below are our responsibility under Article 28(4) GDPR, which is why they are documented here per provider rather than in the Customer's own agreement. For a Customer established in the United Kingdom, UK GDPR applies to that Customer's processing and the UK Addendum noted in the relevant rows covers the onward leg.
1.7 How to read the retention column
The last column of each table describes the provider's own retention, that is, how long data stays on that provider's systems after we send it. It is not our retention schedule. How long we keep Guest Data and Customer Account Data, and what triggers deletion, is set out in the Privacy Policy and, for Guest Data, in the Data Processing Agreement.
Two consequences are worth stating plainly:
- Deletion at our end is not instantaneous everywhere. Encrypted off-site backups are kept for up to six months, so data deleted from the live systems can persist in a backup snapshot for that period. Backups are restored only for disaster recovery.
- Some providers do not publish a retention period. Where that is the case the column says so, instead of quoting a figure we cannot stand behind.
1.8 What this register does not cover
- The Customer's booth software and the hardware vendor behind it. The photo booth software that captures the photo and the survey answers, and sends them to us, runs under the Customer's own arrangements. We receive what it sends.
- Providers the Customer connects with its own accounts. Guest SMS and, where configured, guest email leave our platform through accounts the Customer holds in its own name. They are listed in Table C for transparency, but they are the Customer's processors, not ours.
- The guest-facing privacy notice. The Customer, as controller of Guest Data, informs guests about the processing at the booth, including that the result is AI-generated. We do not contact guests except to deliver their outputs on the Customer's instruction.
2. Table A: Sub-processors of Guest Data
Engaged under Article 28(4) GDPR, acting on the documented instructions of the Customer as controller. Each of these providers handles some part of a guest session: storing the files, running the generation, rendering the branding, or carrying the delivery message. The rows are ordered by how central the provider is to the platform rather than by how much data it sees.
| Provider (entity) | Function and data touched | Processing region | Transfer mechanism | Contractual status | Retention at provider |
|---|---|---|---|---|---|
| Supabase† (Supabase, Inc.; contracting importer Supabase Pte. Ltd, Singapore) | Managed database holding the records a Workflow creates around each guest session: delivery records with the guest's phone number or email address; media job records with the generation prompt and links to the input photo and the generated files; callback and usage records with links to guest outputs and the IP address of the booth computer; short links pointing at guest media | EU, eu-west-1 (Ireland) | Standard contractual clauses, Module 2 and Module 3, with UK Addendum and Swiss annex, under the vendor's data processing agreement | Data processing agreement signed 14 July 2026. Model training: the vendor's terms exclude AI training on customer data without our written consent, which we have not given | Post-termination export window of 30 days, then deletion; account data 60 days; platform backups per plan; breach notice within 48 hours; no AI training on customer data without written consent |
| Cloudflare† (Cloudflare, Inc.) | R2 object storage and delivery of guest media: the booth capture, normalized working copies, AI portraits, report files, videos, video covers and the Customer's overlay assets. Guest files are served from files.boothapps.ai over unguessable HTTPS links without a login, so that a guest can open them directly from an SMS or an email | R2 in the EU jurisdiction (.eu. storage endpoint); delivery network worldwide | Standard contractual clauses, Module 2 and Module 3, with UK IDTA and Swiss annex, under Cloudflare's data processing agreement; Cloudflare participates in the EU-US Data Privacy Framework | Vendor data processing agreement, version 6.4 of 3 April 2026. Model training: not contractually addressed; the vendor's published terms apply. This provider stores and delivers files and runs no model on them | Objects remain until deleted by our software or by our purge routines, including the temporary working copies created during a run; cached copies in the delivery network may briefly outlive a deletion at origin |
| Hetzner Online GmbH (Industriestraße 25, 91710 Gunzenhausen, Germany) | Virtual servers running our own software: the workflow engine, the media router, the video compositing service and our self-hosted error tracking. Every Workflow runs here, and workflow execution records hold the full guest payload: name, phone number or email address, survey answers and links to the photo | EU, Falkenstein data center, Germany | Intra-EU processing; no transfer outside the EEA | Hetzner's standard data processing agreement concluded on the account. Model training: not applicable; the provider supplies virtual servers and runs no model on what we store on them | Hetzner keeps no guest data of its own; it supplies the servers on which our software runs, and holds our account and billing data |
| Vercel† (Vercel Inc.) | Application runtime for boothapps.ai. Guest Data passes through in transit only: delivery requests carrying a guest's phone number or email address and the links to their files. No guest media is stored here | Functions in dub1 (Dublin); request and function logs in the region published by Vercel | Standard contractual clauses, Modules 1, 2 and 3, with UK Addendum, under Vercel's data processing agreement; Vercel is certified under the EU-US Data Privacy Framework | Vendor data processing agreement, auto-incorporated; verified 14 July 2026. Model training: the vendor offers an account-level setting for this, which must be off on the production account before production Guest Data passes through | Runtime logs: 1 hour on Hobby, 1 day on Pro, 30 days with Observability Plus; deletion within a commercially reasonable timeframe |
| Resend† (Resend, Inc.) | Guest email fallback: when the Customer has not connected and verified its own SMTP server, the guest delivery email is sent through Resend and carries the recipient address, the message body and the links. Also sends the Event Success Report to the Customer, which contains links to guest media | United States | Vendor standard data processing terms | Vendor standard data processing terms; written confirmation of the transfer safeguards is part of our current vendor review. Model training: not contractually addressed; the vendor's published terms apply | Message logs on our Resend account, per the vendor's published log retention |
| Amazon Web Services† (Amazon Web Services EMEA SARL, Luxembourg) | Rekognition image analysis: the router sends the guest photo bytes and receives back an estimated apparent gender presentation and an estimated age range. The estimate is used only to build the generation prompt and to select the matching artwork; the router stores nothing from the call | EU, eu-central-1 (Frankfurt) | Standard contractual clauses per Implementing Decision (EU) 2021/914, with UK Addendum, auto-incorporated in the AWS data processing addendum | AI services opt-out policy applied organization-wide on 14 July 2026, which disables storage of service inputs for service improvement and deletes historical copies. Model training: excluded by that opt-out | Stateless per call; improvement storage disabled by the opt-out |
| Renderform (Jakub Pomykała Software, sole proprietorship, Wrocław, Poland, NIP 8943176509) | Overlay rendering: receives a link to the AI portrait and the text fields printed on it, which may include the guest's first name, and returns the branded image or the transparent video overlay | EU, AWS Ireland | Intra-EU processing; no transfer outside the EEA | Click-through data processing agreement published by the vendor; no standard contractual clauses, and none needed inside the EEA. Declared sub-processors include AWS, Google, Cloudflare, Mistral.ai, Sentry EU and Postmark. Verified 14 July 2026. Model training: not contractually addressed; the vendor's published terms apply | Rendered outputs kept 14 days on the free and pay-as-you-go plans, or until the subscription ends on the Pro plan; the vendor offers no deletion API |
| xAI† (X.AI LLC, United States; EU representative under Article 27: Lionheart Squared (Europe) Ltd, Dublin, xai@lionheartsquared.eu) | Default image and video model. Image generation receives the normalized guest photo and the generation prompt, which contains survey-derived text, the estimated gender presentation and sometimes the guest's first name. Video generation receives a cover image built from the AI portrait, plus the prompt. One Workflow (Professional Color Analysis) additionally sends the guest photo inline to xAI's vision model together with an analysis prompt | United States | Standard contractual clauses, Module 2 and Module 3, through xAI's publicly available auto-incorporated data processing agreement, with UK Addendum and Swiss annex. xAI is not certified under the Data Privacy Framework, so the transfer rests on the clauses together with a documented transfer impact assessment | Zero data retention is enabled on our account and was confirmed by the provider's response header on 14 July 2026. Re-verification is part of our annual vendor review. Model training: excluded for API content by the provider's enterprise terms (position verified 14 July 2026 during the sister product's counsel review); re-checked at the annual vendor review | Under zero data retention the provider undertakes not to retain the request content, and it is written neither to logs nor to backups; its default term without that mode is stated in its published terms. Breach notice within 48 hours |
| Replicate† (Replicate, Inc.) | Fallback image generation, used when the default provider fails or its circuit breaker is open: receives a link to the normalized guest photo and the generation prompt, and returns the result by webhook. Two legacy Workflow templates call it directly | United States | Not yet established in writing | Standard vendor terms; enterprise data processing agreement requested, not yet executed. Model training: not contractually addressed; the vendor's published terms apply | Not published by the vendor |
| OpenRouter† (OpenRouter, Inc.) | Text personalization only: survey answers, the guest's first name, the estimated gender presentation and free-text interests are sent to a language model, which writes the personalized report text. No image is sent. Onward model vendors: Google (Gemini models) and OpenAI (GPT models) | United States | Vendor standard data processing terms | Vendor standard data processing terms; written confirmation of the transfer safeguards and of the onward model vendors is part of our current vendor review. Model training: not contractually addressed; the vendor's published terms apply, as do the onward model vendors' terms for their own models | Not published by the vendor |
| Wasabi† (Wasabi Technologies, Inc.) | Encrypted off-site backup: nightly snapshots of the database and of the workflow engine's data volume, which contain Guest Data indirectly. Snapshots are restored only for disaster recovery | EU (eu-central-2) | Vendor standard data processing terms | Vendor standard data processing terms. Model training: not applicable; the provider stores encrypted backup archives and runs no model on them | Snapshots are pruned on our schedule: 7 daily, 4 weekly and 6 monthly, so deleted data can persist in a backup for up to six months |
† Entity name as published by the vendor; the exact contracting entity follows from the applicable agreement.
3. Table B: Processors of Customer Account Data
Engaged under Article 28(1) GDPR, with BoothApps as controller. Where a provider also appears in Table A, the row below states only the additional data set.
| Provider (entity) | Function and data touched | Processing region | Transfer mechanism | Contractual status | Retention at provider |
|---|---|---|---|---|---|
| Supabase† (Supabase, Inc.) | Accounts and authentication, profile and contact details, purchases and billing identifiers, usage counters, the Customer's credentials for its own Twilio and SMTP accounts (encrypted at rest, decryptable only through a service-role routine), and the administrative audit log | EU, eu-west-1 (Ireland) | Standard contractual clauses, Module 2 and Module 3, with UK Addendum and Swiss annex | Data processing agreement signed 14 July 2026. Model training: as in Table A | As in Table A |
| Vercel† (Vercel Inc.) | Hosting of the website and the dashboard; request and function logs, which include visitor IP addresses | Functions in dub1 (Dublin); logs in the region published by Vercel | Standard contractual clauses, Modules 1, 2 and 3, with UK Addendum; Data Privacy Framework certified | Vendor data processing agreement, auto-incorporated. Model training: as in Table A | Runtime logs: 1 hour on Hobby, 1 day on Pro, 30 days with Observability Plus |
| Cloudflare† (Cloudflare, Inc.) | DNS and content delivery for every boothapps.ai host, and Turnstile bot protection on five forms (registration, login, password reset, waitlist and contact). Turnstile receives the visitor's IP address and browser signals as a strictly necessary security measure | Delivery network worldwide | Standard contractual clauses, Module 2 and Module 3, with UK IDTA and Swiss annex; Data Privacy Framework participant | Vendor data processing agreement, version 6.4 of 3 April 2026. Model training: not contractually addressed; the vendor's published terms apply | Turnstile signal retention is not published by the vendor. Cloudflare acts as our processor for blocking bots and as an independent controller for improving its own detection |
| Resend† (Resend, Inc.) | Transactional email to the Customer (account, purchase, usage and lifecycle messages) and relay of the website contact form, which carries the sender's name, email address and message | United States | Vendor standard data processing terms | Vendor standard data processing terms. Model training: not contractually addressed; the vendor's published terms apply | Message logs on our Resend account, per the vendor's published log retention |
| Twilio† (Twilio Inc.), our platform account | Optional. Usage-alert SMS to the phone number the Customer stores in its profile, at 95 percent of the allowance and at the hard limit. No Guest Data passes through our platform account; guest SMS runs exclusively through the Customer's own Twilio account (see Table C) | United States | Vendor standard data processing terms | Vendor standard data processing terms. Model training: not contractually addressed; the vendor's published terms apply | Message logs on our Twilio account, per the vendor's published log retention |
| Upstash† (Upstash, Inc., Delaware) | Where configured: rate-limit counters derived from the request, keyed by IP address and route. Where the service is not configured for a deployment, rate limiting falls back to per-instance memory and no data leaves our runtime | EU deployment | Data Privacy Framework, with standard contractual clauses, Module 2 and Module 3, as fallback, and UK Addendum | Vendor data processing agreement, auto-incorporated; verified 14 July 2026. Sub-processor notices require self-registration at the vendor's trust center. Model training: not contractually addressed; the vendor's published terms apply | Counters expire with their own short rate-limit windows; full deletion within six months after cancellation |
| Google† (Google Ireland Limited and Google LLC) | Google Analytics 4, loaded only after the visitor consents to analytics cookies, with Consent Mode v2. Website usage data only; no Guest Data and no dashboard content | United States and Google's global infrastructure | Standard contractual clauses under Google's data processing terms; Google LLC is certified under the EU-US Data Privacy Framework | Vendor standard data processing terms, accepted with the product. Model training: not contractually addressed; the vendor's published Analytics terms apply | Per the data retention setting configured on the Analytics property |
| Wasabi† (Wasabi Technologies, Inc.) | Encrypted off-site backup of the same systems, whose snapshots also contain Customer Account Data and configuration files | EU (eu-central-2) | Vendor standard data processing terms | Vendor standard data processing terms. Model training: as in Table A | 7 daily, 4 weekly and 6 monthly snapshots |
Tools we run ourselves, which are not third-party processors. Our error tracking (GlitchTip), our feedback portal (Fider), our workflow engine (n8n) and our video compositing service are open-source software running on our own Hetzner servers in Germany. The software authors receive nothing. The infrastructure provider for all of them is Hetzner Online GmbH, whose full row is in Table A. Because the self-hosted error tracking holds an operator's account identifier, email address and request IP address, and the feedback portal holds an operator's account identifier, display name and email address, Hetzner is our processor for Customer Account Data as well as for Guest Data. The row in Table A applies to both domains.
4. Table C: Independent controllers and Customer-contracted providers
| Party | Relationship | What it receives | Their terms |
|---|---|---|---|
| Stripe Managed Payments: Link, LLC (a Stripe company) as merchant of record and seller of record; Stripe, Inc. and its European entity as the payment processors | Independent controller and merchant of record. Link is the seller of record for every BoothApps order, and the receipt and tax invoice are issued in its name ("Sold through Link"). It decides for itself how it processes checkout data, and it is not our processor. Payment happens on its own hosted payment page, not on boothapps.ai | Payment method and payment details, billing name and address, company name, tax identifiers and tax status, transaction and invoice identifiers, and fraud-prevention signals. It passes back to us the name, email address, billing country, business name and tax identification number where given, billing email, tax-exempt status, payment method type, transaction, payment, charge, customer and invoice identifiers, the invoice number and PDF link, and the amounts, tax amount and currencies. It does not pass us the card number, the card brand or last four digits, or the cardholder name | See the provider's own privacy notice, linked from the receipt and from the payment page |
| The Customer's own Twilio account | Operating under the Customer's own contracts, not a BoothApps sub-processor. Guest SMS is sent only through the Twilio account the Customer connects. We hold the credentials encrypted and send on the Customer's instruction | Guest phone number and the message body with the links | The Customer's own agreement with Twilio |
| The Customer's own SMTP provider | Operating under the Customer's own contracts, not a BoothApps sub-processor. Guest email is sent through the Customer's own mail server once it is connected and verified | Guest email address and the message body with the links | The Customer's own agreement with its mail provider |
Deletion at the payment provider. Because the merchant of record is an independent controller, a buyer sends deletion requests about payment data to it, not to us. When it acts on such a request it deletes the customer, payment, charge and invoice objects it holds for that buyer inside our own account with it, and notifies us that it has done so. Our purchase records are kept independently of those objects and are not deleted by that action; they follow the retention periods in the Privacy Policy. The practical consequence for a Customer is that a link to an invoice PDF can stop working after such a deletion, while the purchase record in the dashboard remains.
Deleting a BoothApps.ai account does not reach the payment provider. Our account-deletion process makes no call to it, because it holds that data as a controller in its own right under its own retention rules. That is stated in the Privacy Policy so that no one assumes otherwise.
5. Providers deliberately not listed
These providers are configured in our systems but receive no personal data today. They are named here so that the register is complete, and each entry states what would have to happen before it could move into Table A.
- kie.ai, former image and video generation provider. All provider rows have been disabled since 11 July 2026, when generation moved to xAI directly, and no Guest Data has reached kie.ai since. The adapter code and the API credentials are still provisioned, and a credential-balance check carrying no personal data may still be sent; removing the credentials is on our task list. Re-enabling would require Article 28 terms with standard contractual clauses, a full sub-processor list, binding deletion terms, a documented transfer impact assessment, and an entry in Table A published before any traffic.
- fal.ai, former reserve image provider, disabled. It receives no Guest Data; only a credential-level availability probe without personal data may still be sent. The same conditions as for kie.ai apply before it could be re-enabled.
- Google (Gemini Enterprise Agent Platform on Google Cloud, formerly Vertex AI), conditional reserve provider for AI image generation (Gemini image models). The integration is not enabled: Google receives no guest data today through this path and is not a BoothApps sub-processor for it. Activation requires ALL of the following: (1) a zero-retention configuration verified on the production project: request-response logging disabled, project-level in-memory caching disabled (verified 14 September 2026), and a granted abuse-monitoring exception for prompt logging, with written confirmation that it covers the image models in scope (without the exception, only prompts flagged as suspicious are logged, for up to 90 days, stored in the customer-selected region, reviewed by authorized Google personnel and never used for training); (2) an EU processing region pinned for these models (verified available: europe-west1), so that no guest data leaves the EEA on this path; (3) the Google Cloud Data Processing Addendum accepted on the production account, with the no-training commitment of the Service Specific Terms recorded in the vendor file; (4) a prior update of this Register and of the sub-processor annex to the DPA, with the 30-day notice described in section 1. Google's built-in safety filters may reject individual generations (including images of apparent minors); a rejected generation is handled by the primary provider or fails the job, and no additional data is retained on either side as a result. Google is nonetheless relevant twice over today, and both roles are disclosed above: it is an onward model vendor behind OpenRouter (Table A) and it provides Google Analytics 4 (Table B). The consumer-grade Gemini API (AI Studio) is not used and will not be used for guest data.
- OpenAI (direct integration), none exists. No component of our platform calls OpenAI's API. OpenAI models are reached only through OpenRouter, where OpenAI is named as an onward model vendor in the Table A row. If we ever integrate OpenAI directly, it will be added to Table A, under zero-data-retention terms, before any Guest Data is sent.
- Face++ (Megvii), used by one legacy Workflow template to estimate apparent gender presentation. That template is not connected to any purchasable Workflow, so it cannot be bought, activated or run by a Customer, and no Guest Data reaches Face++. The template is scheduled for removal, and it will not be connected to a purchasable Workflow while this entry stands.
The common rule for all five: a provider named in this section is added to Table A, with a full row, before it processes any Guest Data. The 30-day notice in section 1.5 applies to that addition in the same way as to a new provider.
6. Questions, objections and requests
- Questions about a provider in this register, or a request for a copy of the transfer safeguards we rely on: support@boothapps.ai.
- Objection to a new sub-processor of Guest Data: in writing to support@boothapps.ai within the 30-day notice period, with the remedy described in section 1.5 and in the Data Processing Agreement.
- Requests from a guest about their own data reach the Customer, who is the controller of that data. Where such a request reaches us, we forward it to the Customer and assist the Customer in answering it, under the terms of the Data Processing Agreement.
- Supervisory authority for Innova.uno Sp. z o.o.: the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl.
7. Change log
| Version | Date | Change |
|---|---|---|
| 1.0 | 14 September 2026 | Initial public version. |
| 1.1 | 21 October 2026 | Merchant of record changed. The previous reseller is replaced in Table C by Stripe Managed Payments, with Link, LLC as merchant of record and Stripe as processor of the payment. Checkout moved off our pages to the provider's own hosted payment page. No change to any sub-processor of Guest Data in Table A. |