Sub-Processors
Last updated: September 22, 2026
This page is the canonical, single source of truth for the third-party sub-processors Atellier engages to deliver the Service. It is referenced by the Privacy Policy, the GDPR page, and the Data Processing Agreement.
We give at least 30 days' notice before adding or replacing any sub-processor. Subscribers receive notifications by email; you may also object on reasonable data-protection grounds during that period.
Current Sub-Processors
Each provider below is bound by data-protection terms no less protective than our DPA. Atellier remains responsible to Customer for Sub-Processor performance.
| Sub-Processor | Purpose | Data Shared | Location |
|---|---|---|---|
| Supabase | Database, authentication, file storage, realtime | Account data, Customer Data, files, auth tokens | United States (AWS) |
| Stripe | Payment processing, subscriptions, invoicing | Name, email, billing address, payment method | United States |
| Twilio | SMS, voice calls, telephony | Phone numbers, message content, call metadata, recordings | United States |
| Resend | Transactional and marketing email delivery, open/click tracking | Recipient email, message content, engagement events | United States |
| OpenAI | AI features (Carl assistant, content generation) | Prompts plus the org records (deals, clients, messages, etc.) the Carl assistant retrieves to answer them, scoped to the requesting user's organization and permissions | United States |
| xAI | AI features (alternative model provider) | Prompts plus the org records the Carl assistant retrieves to answer them, scoped to the requesting user's organization and permissions | United States |
| Black Forest Labs (BFL) | AI image / mockup generation | Image prompts, reference images | Germany / United States |
| Lovable AI Gateway | AI request routing and inference | Prompts plus org records the Carl assistant retrieves, routed to the underlying model provider | United States / EU |
| Sentry (Functional Software, Inc.) | Error monitoring and masked error replays (signed-in app sessions only, captured when an error occurs) | Error details, stack traces, browser/device metadata, page URL, limited performance timings; replays with all text and inputs masked and media blocked | United States |
| GIPHY | GIF search (only when a user opens the GIF picker) | Search terms; the selected GIF is loaded from GIPHY, which receives the viewer's IP address and browser metadata | United States |
| Unsplash | Stock photo search and hotlinked images (only when a user searches or inserts Unsplash photos) | Search terms; images are loaded from Unsplash, which receives the viewer's IP address and browser metadata | Canada / United States |
| DeepL | Message translation (only when a user requests a translation) | Text of the message being translated | Germany / EU |
| Expo (650 Industries, Inc.) | Mobile push notification delivery | Device push tokens, notification title and body | United States |
| OpenStreetMap (Nominatim) | Address geocoding and map tiles for install/route maps | Job-site addresses being geocoded; map tiles are loaded from OpenStreetMap, which receives the viewer's IP address | United Kingdom / EU |
| Google Calendar sync, OAuth login, Maps | Email, calendar events, OAuth tokens, address geocoding | United States | |
| Meta (Facebook, Instagram, WhatsApp) | Inbox channels — DM and message sync | Page tokens, messages, contact identifiers | United States / Ireland |
| Shopify | E-commerce order and product sync | Orders, customers, products, store metadata | Canada / United States |
| QuickBooks (Intuit) | Accounting sync — invoices, payments, customers | Invoice data, payment records, customer records | United States |
| Xero | Accounting sync — invoices, payments, customers | Invoice data, payment records, customer records | New Zealand / United States |
| EasyPost | Live package tracking across carriers (UPS, FedEx, USPS, DHL and others) | Tracking numbers and carrier names; EasyPost returns the carrier's scan history, which can include delivery city/state | United States |
| ShipStation | Shipping label generation and order fulfillment | Shipping address, order details, recipient contact | United States |
| OpenPhone | Alternative telephony / SMS provider | Phone numbers, message and call metadata | United States |
| QUO | Telephony — click-to-call, screen pop, call logs | Phone numbers, call metadata, recordings | United States |
| Zapier | Customer-configured webhook automations (only when you enable) | Whatever fields you map into your Zap | United States |
| AWS | Underlying cloud infrastructure (via Supabase) | All data stored / processed by Supabase | United States |
| Cloudflare | CDN, DNS, edge caching, DDoS protection | IP addresses, request metadata | United States / Global edge |
We update this list as our infrastructure evolves. Material changes are reflected by updating the "Last updated" date on this page.
Objection Process
If a Customer with an executed DPA objects to a new Sub-Processor on reasonable data-protection grounds during the 30-day notice window, Atellier will work in good faith to identify a commercially reasonable alternative. If none is available, Customer's sole remedy is to terminate the affected portion of the Service and receive a pro-rata refund of prepaid, unused fees.
Customer-Initiated Integrations
Some sub-processors only receive data when a Customer enables an integration (for example, Shopify, QuickBooks, Xero, Zapier, Google Calendar, Meta Inbox, OpenPhone). Disabling the integration stops further data flow.
Contact
Questions: hello@meonneon.com
Worldwide Signage Ltd. d/b/a Atellier
8405 W 54th Place
Arvada, Colorado 80002
United States