Subprocessors
Last updated: 25 October 2026
These are the kinds of service providers that process personal data for Capturely to run the Service, including the data of photographers' clients that we process as a processor under our Data Processing Agreement. Data processing agreements with each subprocessor are in place or being put in place.
1. Categories of subprocessors
| Category | What they do for us | Data they process | Where the data is | Transfer safeguard |
|---|---|---|---|---|
| Application hosting | Runs the application, background tasks, scheduled tasks and server logs | All data passing through the application, including photo uploads during processing, IP addresses and error logs | EU | Data is hosted in the EU; any access from outside the EEA is covered by the safeguards in section 3 |
| Database hosting | Hosts our database, which also holds sessions and background tasks | All account, gallery, client, statistics and session records | Switzerland | EU adequacy decision for Switzerland; any access from outside the EEA is covered by the safeguards in section 3 |
| File storage for photos | Stores photo originals, resized versions, portfolio photos and site images | Photos and the metadata embedded in them | May be processed outside the EEA | The safeguards in section 3 |
| Payment processing (our payment processor, shown at checkout) | Payments, subscriptions, invoices, the billing portal | Photographers' names, email addresses, payment details, billing history. No client data | EU, with transfers outside the EEA | The safeguards in section 3. The payment processor is also an independent controller for some purposes, such as fraud prevention and its legal obligations |
| Email delivery | Sends our emails: account emails, notifications and digests to photographers, gallery-ready and expiry reminder emails to clients, site contact form messages to photographers | Email addresses, names and the content of those emails (which can include client names and comments) | May be processed outside the EEA | The safeguards in section 3 |
| Email and lifecycle messaging | Sends our emails to photographers about using Capturely: getting started, asking for feedback, a free gallery about to close, our paid plans | Photographers' email addresses, first names, time zones, languages, plan and subscription status, the date and source of sign-up, and what they do in Capturely as events and counts (for example a gallery created or sent, photos uploaded, the number of photos a client selected), with gallery titles as the photographer wrote them. No client details | May be processed outside the EEA | The safeguards in section 3 |
| Website analytics | Measures visits to our own website, and the sign-up measurement described in our Privacy Policy, only with the visitor's or photographer's consent | Browser and device details, pages viewed, identifiers stored in cookies, and for photographers who allowed it at sign-up the reported events | May be processed outside the EEA | The safeguards in section 3 |
| Web font delivery for portfolio sites | Delivers the web fonts used on photographers' portfolio sites | Visitors' IP addresses and browser details when a site loads | Provider established in the EU | Any delivery from outside the EEA is covered by the safeguards in section 3 |
Advertising platforms that receive data from our website with a visitor's consent are not our subprocessors: they use it for their own advertising purposes as independent controllers (see our Privacy Policy, Parts C and D).
2. The named list
The current named list of our subprocessors is available to customers on request at hello@capturely.me.
We notify customers by email at least 30 days before we add or replace a subprocessor, and we update this page. Customers may object to the change as section 3.2 of our Data Processing Agreement describes.
3. Transfers outside the EEA
Some of our providers are companies based outside the European Economic Area, or may access data from outside it. Each such transfer is covered by an adequacy decision of the European Commission (including the EU-US Data Privacy Framework for certified companies) or by the European Commission's Standard Contractual Clauses.
4. Services the photographer chooses
These are not our subprocessors. The photographer turns them on and is responsible for them.
| Category | Data sent | Who is responsible |
|---|---|---|
| A sign-in provider | When a photographer signs in with an external account, the provider returns the photographer's email address and name to us | The provider, as an independent controller for its sign-in service |
| A messaging app for notifications | Notification text about selections and reviews (gallery title, client name, the start of a comment) | A recipient the photographer chose |
| The photographer's own webhook or automation tools | Gallery events: type of event, gallery address and title, time, and depending on the event the photo ID and file name, the number of selected photos, the review rating and the reviewer's name | A recipient the photographer chose |
| Analytics and advertising tools in galleries | Loaded in a photographer's galleries only after the visitor consents. Data is collected by the tool's provider directly from the visitor's browser | The photographer |
| Video platforms | Videos a photographer embeds on their portfolio site; the visitor's browser connects to these services directly | The photographer |