Checking account…
Legal
Evidence status · Customer-facing source update · 23 August 2026
Art Licence Studio uses service-provider categories such as hosting, authentication/database/storage, security and bot prevention, error monitoring, email delivery, and optional analytics or AI only where the relevant function is enabled. Payment-provider disclosures apply to paid checkout and billing flows that the server actually enables; repository integrations alone do not prove production use.
Supabase, Inc.
Authentication, database hosting, and private/public file storage
Location: European Union hosting with provider-controlled support and access boundaries
Transfer note recorded in source, not professional transfer approval: Current DPA, processing locations, onward transfers, and the applicable UK transfer safeguard require owner review before approval
Vercel Inc.
Application hosting, edge delivery, request routing, and deployment logs
Location: Global edge and provider-controlled processing locations
Transfer note recorded in source, not professional transfer approval: Current DPA, processing locations, onward transfers, and the applicable UK transfer safeguard require owner review before approval
Cloudflare, Inc. (Turnstile)
Bot prevention and abuse protection on authentication and public submission routes
Location: Global security network and provider-controlled processing locations
Transfer note recorded in source, not professional transfer approval: Current DPA, processing locations, onward transfers, and the applicable UK transfer safeguard require owner review before approval
Stripe, Inc.
Payments, subscriptions, identity verification, marketplace onboarding, and payouts
Location: Provider-controlled processing locations, including outside the United Kingdom
Transfer note recorded in source, not professional transfer approval: Current DPA, controller/processor roles, processing locations, onward transfers, and the applicable UK transfer safeguard require owner review before approval
Resend, Inc.
Transactional account, order, licence, billing, and operational email delivery
Location: Provider-controlled processing locations, including outside the United Kingdom
Transfer note recorded in source, not professional transfer approval: Current DPA, processing locations, onward transfers, tracking posture, and the applicable UK transfer safeguard require owner review before approval
Supabase and Vercel provide the application infrastructure. The production build requires Cloudflare Turnstile for bot protection. Stripe is required for the paid licence, commission, subscription, identity and Artist-payout flows. The final paid launch also requires Resend transactional-email evidence, so Resend is included rather than hidden behind a repository-integration label.
Inclusion means the provider is required by the paid-launch source posture. It does not claim that the serving production deployment has enabled the provider or that its DPA, locations, onward transfers or UK transfer safeguard have been owner-approved.
Register version: paid-launch-enabled-processors-2026-08-23-v1. Production enablement observed: false. International-transfer mechanisms reviewed: false. Owner approval claimed: false.
Before a named list is published, the privacy owner must verify the legal entity, purpose, data categories, production location, onward processing, contract/DPA status, international-transfer mechanism, access controls and deletion behavior for each enabled provider. Material changes must then follow the notice required by the approved policy and contract; this draft does not promise an unverified fixed notice period.
Processor questions: privacy@artlicencestudio.co.uk