Sub-processor list
Version 1.0 · 5/21/2026
ISL may update this list. Material changes will be notified to artists with reasonable prior notice.
| Provider | Purpose | Region | Safeguards |
|---|---|---|---|
| Supabase | PostgreSQL database | EU (Frankfurt) | DPA / GDPR |
| Cloudinary | Image storage and delivery | EU / USA | SCC |
| Anthropic | AI photo analysis (optional) | USA | SCC — only with consent |
| Resend | Transactional email | EU | GDPR |
| Twilio | Operational WhatsApp message delivery | EU / USA | SCC |
| Meta Platforms (WhatsApp) | Operational WhatsApp message delivery | EU / USA | SCC |
Stripe (payments) — mentioned in planning; not implemented in this staging version.
WhatsApp messages are strictly operational (a secure questionnaire link) and are sent only with the client’s explicit agreement. The phone number, message identifier, delivery status and any replies are processed. No questionnaire answers, medical data, allergies, recipes or photographs are transmitted. The client may reply STOP at any time to stop messages.