sartoria.

Subprocessors

The third-party providers Codifiq LLC uses to operate Sartoria.

Version 2026-07-27 · Effective 27 July 2026

Current subprocessors

We keep this list short on purpose. These are the only third parties that process data on our behalf to deliver Sartoria.

Vercel Inc.
Application hosting and content delivery, United States. Processes requests and responses as they pass through the application, including uploads and generated images in transit, and holds operational logs containing IP addresses and timestamps. Serves the application from the US West region.
Supabase Inc.
Database, authentication and file storage, United States (US West). Processes all stored application data: account records, organisation and brand records, style and tech pack data, generation history, and uploaded and generated image files. Manages passwords as hashes and issues session tokens.
Google LLC
AI image generation and image analysis through the Gemini API, United States. Receives the source and reference images for a generation and the composed text prompt. Does not receive account identifiers. Under Google’s paid API terms it does not use this content to train its models, and retains it only briefly for abuse monitoring and legal compliance.
Resend Inc.
Delivery of authentication email — signup confirmation, password reset, and workspace invitations, United States. Receives the recipient’s email address and the contents of those messages. It is not used for marketing.

What is deliberately absent

The following categories of vendor are not used at all, which is worth stating explicitly because most SaaS subprocessor lists are full of them:

  • No product analytics or session replay.
  • No advertising, attribution or marketing automation.
  • No third-party error tracking or log aggregation.
  • No payment processor — the Service is free during beta.
  • No customer support widget or chat tool embedded in the product.

Changes to this list

We will give customers at least thirty (30) days’ notice by email before adding or replacing a subprocessor, and a customer may object on reasonable data protection grounds as described in our Data Processing Addendum. To be notified, or to ask a question about a provider, write to privacy@codifiq.com.