These are the companies that process personal data for PhotoPostman on behalf of BrandPacks Limited. Each one is bound by a written contract with data protection terms.
We give account owners at least 30 days' notice by email before we add or replace a subprocessor, and we update this page at the same time. You can object as described in section 5 of our Data Processing Agreement.
Current subprocessors
| Provider | What it does for us | Data involved | Where |
|---|---|---|---|
| Cloudflare, Inc. (United States) | Runs the PhotoPostman application (Workers), database (D1), file storage (R2), job queues, image previews, custom gallery domains, network delivery and security protection | All service data: account and event records, event media, previews, temporary ZIP files, technical request data | Database and file storage use Cloudflare's EU jurisdiction, so data at rest stays in the EU. Requests are handled at Cloudflare's global network of data centres, so data in transit and short-lived processing can occur outside the EU |
| DigitalOcean, LLC (United States) | Media processing server (previews, playable video and audio, ZIP files). Cold Storage for verified copies of hosted originals and the 90-day recovery archive | Event media and the minimum records needed to process, restore and delete it | Processing server: Frankfurt, Germany. Cold Storage: To be confirmed confirm EU region |
| Twilio Inc. (SendGrid) (United States) | Sending service emails (verification, delivery links, expiry, export, billing and price notices) | Email addresses, names, business display names, message content and links (no media attachments), delivery status | To be confirmed confirm whether EU data residency is enabled; otherwise United States |
| Spatie BV (Mailcoach) (Belgium) | Optional marketing and onboarding emails, only to account owners who opted in | Account owner name, email address, language, plan, trial and onboarding stage, consent and unsubscribe records | To be confirmed confirm hosting location |
Guests, organisers and transfer recipients are never sent to Mailcoach.
Payments: Paddle
When paid plans are available, Paddle (Paddle.com Market Limited, United Kingdom, or the Paddle group company named at checkout) sells them to you as merchant of record. Paddle handles checkout, payment, tax, invoices and refunds as an independent controller under its own privacy notice, and not as our subprocessor. We receive your plan, subscription status, billing country and Paddle reference numbers, but never your full card details. Paddle has no access to your event media.
Services you choose to connect
Dropbox, Google Drive and Microsoft OneDrive are not our subprocessors. If you connect one of them, it is your own provider, used under your own agreement with it. We access only the folders you select, with the permission you grant, and we never delete or edit your files there. Originals you keep there remain under that provider's terms and are not covered by our recovery archive.
TemplatesBooth is a separate service. If you link it, we exchange only the data needed for the integration (your event list, QR codes and preview links), at your request.
Changes
| Date | Change |
|---|---|
| 2026-11-04 | First published |