These are the third parties that process personal data on our behalf so that the Service can run. This page is the authoritative list referenced by the Data Processing Agreement and the Privacy Policy.
Why this page names names
Our status board describes services by function and never by vendor, because a public list of our components is a gift to anyone probing for a weakness. A sub-processor list is the opposite case: Article 28 GDPR gives you the right to know exactly who touches your data and to object, and you cannot exercise that right against an anonymous “database provider”.
Current sub-processors
| Provider | What it processes | Location |
|---|---|---|
| Vercel Inc. | Hosts the website and the API, routes requests, and runs the serverless functions that render documents. Processes request metadata, IP addresses and, transiently, in memory, payload content during a render. | United States, with edge processing in the region nearest the request |
| Supabase, Inc. | Database, authentication and object storage. Holds account records, plan and quota state, cloud folders, the PDF files you choose to save, and the aggregate site measurement counts described in the Cookie Policy. | Data hosted in the European Union, Central EU (Frankfurt), eu-central-1. Corporate entity in the United States. |
| Stripe Payments Europe, Ltd. | Card and wallet payments (Apple Pay, Google Pay), subscriptions, invoices, receipts and fraud prevention. Receives the name, email and billing address entered at the checkout and the card details, which are typed directly into Stripe's own fields, we never receive a card number. We keep only the reference that links your account to its Stripe customer. | European Union, Dublin, Ireland. Transfers to Stripe, Inc. in the United States under the EU–US Data Privacy Framework and Standard Contractual Clauses. |
Addresses
Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, United States, privacy@vercel.com.
Supabase, Inc., 3500 S. DuPont Highway, Kent 19901, Dover, Delaware, United States.
Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland.
Databases, authentication records and stored documents reside in the Central EU (Frankfurt) eu-central-1 region. Personal data held in PrysM Cloud therefore stays within the European Union at rest.
Announced in advance
The providers below are not yet engaged and process no data today. We publish them ahead of time so the 30-day objection period set out in the DPA can run before anything changes, that notice period is the point of this section.
| Provider | Purpose | Status |
|---|---|---|
| Transactional email | Account email: address confirmation, password reset, billing notices. Receives your email address and the message content. | Announced | handled today by the authentication provider above |
Each entry is replaced with the provider’s name, address and processing location on this page before it receives any personal data, and never before the notice period has run.
Safeguards
- Each sub-processor is engaged under a data processing agreement with obligations no less protective than those we owe you.
- Transfers outside the European Economic Area rely on the European Commission’s Standard Contractual Clauses, supplemented where applicable by the EU–US Data Privacy Framework.
- We remain fully liable to you for the performance of every sub-processor.
- Access is limited to what each provider needs to deliver its part of the Service.
Notice of changes and your right to object
We announce any intended addition or replacement on this page at least 30 days before it takes effect, and by email to customers who have asked to be notified. To be added to that list, write to privacy@prysm.tools with the subject line Sub-processor notifications.
You may object on reasonable data protection grounds within that period. If we cannot accommodate the objection, you may terminate the affected part of the Service without penalty and receive a refund of the unused portion of any prepaid period.
A question about any of this?
Write to legal@prysm.tools and a person will answer.
Published in English. Any translation is provided for convenience only; where they differ, the English text prevails, except where mandatory local consumer law provides otherwise.