Third-party services
Last updated: 12 November 2026
These are the companies PhotoLuxie uses to operate. Only Cloudflare processes photographers' photos and client information (a "subprocessor" under the Data Processing Agreement). Before a new company that would process them is added, we notify photographers by email at least 15 days in advance.
| Company | What it does | Which data | Where |
|---|---|---|---|
| Cloudflare, Inc. | Hosting of the application, database, file storage, network protection | Everything: accounts, galleries, photographs, client information | Database under EU jurisdiction; files in Eastern Europe. Requests pass through Cloudflare's global network (USA): EU–US Data Privacy Framework and Standard Contractual Clauses. |
| Resend (Plus Five Five, Inc.) | Sending email to photographers (sign-up codes, account and subscription notices, receipts and invoices for payments) and confirming content reports | Recipient address and message content; no photographs or client information | USA: EU–US Data Privacy Framework and Standard Contractual Clauses. |
| Stripe (Stripe Payments Europe, Limited) | Subscription payments and the subscription management page | The photographer's payment and billing details; no photographs or client information. Only Stripe sees the card number. | Ireland, with possible transfer to the USA: Standard Contractual Clauses. For its own purposes (e.g. fraud prevention) Stripe is an independent controller. |
| The browser's notification service (e.g. Google for Chrome, Apple for Safari, Mozilla for Firefox) | Delivering notifications to the photographer's device, only if they enable them. The browser chooses the service. | The device's notification address and the time. The notification's content leaves encrypted with a key only the device has, so the service cannot read it. | Depends on the service, including outside the EU; what it carries is encrypted. |
| Google (Google Calendar) | Connecting the photographer's Google Calendar, only if they ask for it: we show them their events and write their shoots to the calendar they choose. | The Google account they connect and its events (read, not stored). For every shoot that is written: title, day, time and a link to PhotoLuxie; no client phone number, email or note. | The photographer's own Google account; depending on Google, including outside the EU. |
| Google (Sign in with Google) | Signing in and signing up to the Admin with the photographer's Google account, only if they choose it: Google confirms who they are. | Google tells us the email of the Google account, whether it is verified, and a stable account identifier. It receives nothing from us; no client details. | The photographer's own Google account; depending on Google, including outside the EU. |
We do not use advertising, analytics or tracking services. Fonts are loaded from our own servers.