Subprocessors
The third parties that process data on our behalf, what each one receives, and where it runs.
Only one of them — our hosting provider — ever holds an uploaded image or a face embedding. The database, object storage, cache, authentication service and the models themselves all run on our own servers rather than a managed service, which is why this list is shorter than you might expect.
| Subprocessor | Purpose | What it receives | Where |
|---|---|---|---|
| Contabo GmbH | Infrastructure and hosting | Everything. Application servers, the Postgres database, uploaded images, face embeddings and backups all run on machines we rent here. | Germany and the Netherlands (EU) |
| Dodo Payments | Payments, acting as Merchant of Record | Name, email, billing address, tax identifiers and card details. Card numbers are entered on their checkout and never reach our systems — we receive the card brand and last four digits. | United States, with EU processing for EU customers |
| Amazon Web Services | Transactional email delivery (SES) | Recipient name and email address, and the contents of the message — a payment receipt, a usage warning, a password reset. | United States (us-east-1) |
| Google LLC (Google Analytics) | Website analytics | Which pages are visited and in what order, an approximate location derived from your IP address, your device and browser, and a randomly generated identifier held in a cookie. It is not joined to your account, and no uploaded image, extracted text or face data is sent to it. | United States, with EU collection endpoints for EU visitors |
| Google LLC / GitHub, Inc. | Optional single sign-on | Only if you choose to sign in with one of them, and only the identity they assert: your email address, name and avatar. Sign in with a password and neither is involved. | United States |
What we do not use
No advertising or session-recording service runs on this site. Google Analytics does, and it is listed above: it records which pages are visited, not what you do inside the product. We do not use a third-party error-monitoring service in production. We do not send customer data to any model provider — the face and document models are ours and run on our own hardware, so nothing you upload is used to train anyone else's system, including ours.
Changes to this list
Email privacy@quantilence.com and we will tell you before we add a subprocessor that would handle your data, with enough notice to object. See also our security practices and privacy policy.