Sub-processors

The complete list of service providers that process personal data on our behalf, what each one does and what actually reaches them.

Last updated 30 August 2026

This document is a draft

It was written against how StreetShape actually works, and every factual claim in it is checkable against the code. What it does not yet have is the company details, the governing law and the retention periods a human has to decide, or a review by a lawyer. Those gaps are marked in the text rather than filled with a guess.

31 outstanding items— show

legal entity name
country of incorporation
company registration number
VAT number
registered office address
EU representative, if the entity sits outside the EU
data protection officer, if one is required
supervisory authority
supervisory authority website
governing law and jurisdiction
ADR body to signpost, if the jurisdiction requires one
minimum age — GDPR Art. 8 allows 13 to 16 by member state
refund position, beyond the statutory withdrawal right
liability cap
voluntary refund window — the draft recommends 30 days
window for refunding a renewal somebody meant to cancel — the draft recommends 14 days
acknowledgement time for a vulnerability report — the draft recommends 2 working days
coordinated disclosure window — the draft recommends 90 days
notice period before a new sub-processor starts, for accounts with a DPA — the draft recommends 30 days
canonical domain — the code uses streetshape.app, the site publishes streetshape.io
Whether classroom use is supported — the education material invites it, which makes under-16 users foreseeable and decides the minimum age above.
The statutory retention period for accounting records in the country of incorporation.
Retention windows for municipality demo requests, the email log, and stored Paddle webhook payloads.
Whether Paddle's checkout captures the Art. 16(m) consent and acknowledgement the Terms rely on for digital content supplied immediately.
The region each processor runs in, and the transfer mechanism relied on for each.
Review of all nine documents by a lawyer in the jurisdiction of incorporation.
Whether a data processing agreement is actually executed with each provider on the sub-processor list, and whether a StreetShape DPA template exists for a municipality or university to sign.
Which imagery and elevation providers sit behind MapTiler's satellite and terrain styles, read from the styles themselves rather than written from memory.
Whether MapTiler's agreement permits printing and republishing satellite imagery, which is a different grant from viewing it on screen.
Whether the Digital Services Act treats StreetShape as a hosting service or an online platform — public proposal boards and consultations point at the second, which carries notice-and-action, statement-of-reasons and appeal duties.
Whether access to production data is logged, and whether a backup restore has ever actually been run.

1. The current list

We use a small number of providers to run StreetShape. Each processes personal data on our instructions and none may use it for its own purposes. This page is the current list, and it is the list referred to by our privacy policy and by any data processing agreement we sign.

The companies that process personal data on our behalf
Provider	What they do	What reaches them	Where
Clerk	Accounts, sign-in and session security	Email address, name and avatar if you have one, your password or the social account you signed in with, sessions and two-factor settings	[Clerk region]
Supabase	The database, and storage for plan thumbnails	Everything the service stores: your account record, your plans and their versions, preferences, subscription and usage records	[Supabase project region]
Paddle	Payment, as merchant of record — as an independent controller, not our processor	Name, billing address, country, tax status, payment method and invoices. We never receive card details	[Paddle region]
MapTiler	Basemap tiles and satellite imagery	Tile requests made by your browser: the coordinates and zoom you are looking at, your IP address and user agent	[MapTiler region]
Komoot (Photon)	Address search	The text you type into the location search. The request is made by our server, so your IP address is not sent	EU
OpenStreetMap Foundation (Nominatim)	Address search, when Photon is unavailable	The same search text, on the same terms	EU
Resend	Transactional email — collaboration invites	The recipient's email address and the contents of the message	[Resend region]
[hosting provider]	Running the site	Ordinary web-server logs: IP address, user agent, requested URL	[hosting region]

Rendered from the same definition the privacy policy and the data-rights page read, so adding a provider is one line in a reviewed diff and it appears on all three pages at once.

2. Paddle is not a sub-processor

Paddle is our merchant of record, not our processor. Paddle sells the subscription to you, takes the payment, handles VAT wherever you are and issues the receipt. For your payment data it is an independent controller and its own privacy notice governs it.

It is on the list because you should know it is in the chain, not because it is a sub-processor in the legal sense.

One consequence worth stating plainly: no card details reach us, ever. There is no payment code and no tax logic in this product because there is nothing for either to operate on.

3. Address search

When you type a location into the search field, that text is sent to a geocoder to be resolved into coordinates — Photon, run by Komoot in Germany, with the OpenStreetMap Foundation’s Nominatim as a fallback. Both are in the EU.

The request goes out from our server rather than from your browser, so your IP address is not disclosed to either of them. We do not store what you searched for. The text itself does leave us, so do not type anything into the search field you would not want sent to a third party.

4. What we do not use

No advertising networks. No data brokers. No third-party analytics. No session replay. No customer data platform.

That is a statement about the dependency list rather than a position we intend to hold: there is no analytics or advertising package anywhere in the product, which is also why there is no cookie banner.

If we ever add anything in one of those categories, it goes on this page before it goes into the product.

5. Changes to the list

We update this page when a provider is added or removed, and the date at the top changes with it.

If you hold a data processing agreement with us — a municipality, a university, an organisation — we will give you [notice period before a new sub-processor starts, for accounts with a DPA — the draft recommends 30 days] before a new sub-processor starts, and you may object on reasonable data-protection grounds. Email hello@streetshape.io to be on that notification list.

6. What is not settled yet

Two things on this page are marked as gaps rather than filled in, and they are the two a data protection office will ask about first:

The region each provider runs in, and the transfer mechanism relied on where that is outside the EEA.
Whether a data processing agreement is executed with each one, and whether we have a StreetShape agreement of our own for an institution to sign.

If you need either of those answered before you can proceed, write to hello@streetshape.io and you will get a straight answer rather than a page that guessed.

What we collect and why is in the privacy policy. How to exercise a right over it is on the data rights page. How the service is built and how to report a vulnerability is on security.