These are the providers (sub-processors) that process personal data so that Passly can operate. All of them act under contract, only for the stated purpose and with confidentiality and security obligations. The list is generated from the services that the code actually uses.
1. Sub-processors
| Provider | Service | Purpose and data | Location | Safeguards |
|---|---|---|---|---|
| SupabaseSupabase, Inc. | Database, authentication and storage | Hosts the database, accounts and (hashed) passwords, uploaded files, and sends access emails (confirmation, password recovery).All account, event, guest, RSVP, gallery and file data. | United States (AWS us-west-2, Oregon) | Provider's data processing agreement and standard contractual clauses |
| VercelVercel Inc. | Hosting, content delivery and analytics | Serves the site and runs Passly's server; with your consent, measures aggregate visits (Web Analytics).IP address and technical request data, short-lived technical logs. | United States and global edge network | Provider's data processing agreement and standard contractual clauses |
| StripeStripe, Inc. y sus afiliadas | Payments, subscriptions and tax | Processes card payments, subscriptions, receipts and, when enabled, tax calculation. Passly never sees or stores your full card number.Name, email, card data (Stripe only), billing country and address, amounts. | United States | Provider's data processing agreement and standard contractual clauses |
| AnthropicAnthropic, PBC | Artificial intelligence | AI features that may contain personal data: importing guest lists from photos or text, generating invitation designs and copy from your event details and reference photos.The text, images and event details you send to the AI feature. | United States | Provider's data processing agreement and standard contractual clauses |
| Moonshot AI (Kimi)Moonshot AI | Artificial intelligence (design only) | Only pure design requests (styles, palettes, layouts) without personal data. By default every request is treated as personal and goes to Anthropic; Moonshot never receives guest lists, photos or your event details.Design instructions without personal data. | Outside Mexico, the EU and the US (see provider) | No personal data is transferred to it |
| GroqGroq, Inc. | Speech transcription | Turns the voice notes you record to describe your event to the AI into text.The voice recording you send. | United States | Provider's data processing agreement and standard contractual clauses |
| OpenAIOpenAI, L.L.C. | Speech transcription (fallback) | Fallback for voice-note transcription when Groq is unavailable.The voice recording you send. | United States | Provider's data processing agreement and standard contractual clauses |
2. Third-party services activated by the guest
These are not sub-processors: they are services that a person chooses to load in an invitation and that process data under their own responsibility and their own policies.
| Service | Where | When it connects |
|---|---|---|
| Google Maps (Google LLC) | Event location map | Only loads when you tap “Show map”; until then, Google receives nothing. |
| YouTube (Google LLC) | Background music on some invitations | Only loads, in privacy-enhanced mode (youtube-nocookie.com), when you press play. |
3. Notice of changes
Before engaging a new sub-processor that processes customer data, we will update this page and give notice within the app at least 30 days in advance, in accordance with the Data Processing Agreement. The date and version history are at the bottom of this page.
Version history
- v1.0 · October 1, 2026 · Material change — First published version.