Subprocessors

Purpose: application hosting, content delivery, serverless execution, security, request logging and optional aggregate web analytics.

Data: request metadata, IP and device/network information available in infrastructure logs, application responses and optional analytics events after consent.

Location and transfers: processing locations depend on Vercel infrastructure and account configuration. Contractual transfer safeguards and the applicable Vercel data processing terms are used where a restricted transfer occurs.

Purpose: managed Postgres database, authentication, account administration, row-level security, file storage and related service operations.

Data: account identifiers, company and workspace records, authentication metadata, stored files and technical logs required for the enabled Supabase services.

Location and transfers: primary project data is processed in the selected Supabase project region. Limited support, security or service operations may involve other locations under Supabase contractual safeguards.

Purpose: subscription checkout, customer billing portal, payment processing, payment status, invoices, fraud prevention and financial compliance.

Data: billing contact, payment method and transaction information, Stripe customer/subscription references, company reference and payment status. Stripe handles full card data directly.

Location and transfers: Stripe operates internationally and applies its data processing terms and lawful transfer mechanisms. Stripe may also act as an independent controller for regulated payment, fraud and legal obligations.

Purpose: optional product analytics used to understand page usage and improve the service.

Data: consented page path and product event information. Riera Studio disables automatic element capture and session recording in its PostHog configuration.

Activation: PostHog is not initialised by Riera Studio until analytics consent is accepted. The configured host uses the PostHog EU ingestion endpoint unless the deployment configuration is changed.

Purpose: optional aggregate website usage and performance measurement.

Data: analytics information produced by the Vercel Analytics integration after consent. It is not rendered by Riera Studio before analytics acceptance.

Riera Studio may replace or add providers where necessary for security, reliability or product operation. A material new subprocessor is added to this page before use where practical.

Business customers with a reasonable data protection objection should contact Riera Studio promptly. The process in the Data Processing Addendum applies.