Boetiek House S.L., CIF B75865022, Calle Fernando Fuentes 2, 38300 Santa Cruz de Tenerife, Spain ("VergeLabs") engages the processors below to deliver the VergeLabs Media Library AI service. This list is published because Art. 28(2) GDPR requires a controller to be told about sub-processors, and because a customer cannot assess our processing without knowing who else touches it.
Last reviewed: 2026-08-29.
Who processes what
| Sub-processor | Purpose | Data reached | Location |
|---|---|---|---|
| OpenRouter, Inc. | Model routing — the live path for every description | The downsized image, its filename and surrounding text context | United States; upstream endpoints vary, constrained as below |
| Anthropic PBC | Generating image descriptions, only where a deployment is explicitly configured to call Anthropic directly | Same as above | United States |
| Vercel Inc. | Application hosting and edge network | All request traffic in transit; request metadata in logs | United States / global edge |
| Stripe, Inc. | Payment processing, tax calculation, invoicing | Name, email, billing address, country, payment details | United States / Ireland |
| Plus Five Five, Inc. (trading as Resend) | Transactional email — licence delivery, account confirmation | Email address and message contents | United States |
| Supabase Inc | Postgres: licences, credit ledger, accounts, job records | Account email, licence keys (hashed), usage counters | AWS eu-west-1, Ireland |
No image is ever stored by us. Images pass through in memory to the model
provider and are discarded when the request ends. Our database holds usage
counters, not customer media. This is asserted in docs/ai-service.md as a
server-side obligation and is what the code does.
How the routing promise is kept
The product promises zero-retention routing. OpenRouter is a router: it forwards to whichever upstream serves the model, so that promise is only worth anything if it is stated on every request rather than set once on an account where no customer can see it and no code review can check it.
lib/routing.ts puts two flags on every describe call:
| Flag | Effect |
|---|---|
zdr: true |
Route only to Zero Data Retention endpoints. |
data_collection: "deny" |
Refuse any provider that may store the data at all. |
Both, not one: a provider can sit outside the ZDR programme and still not
train on inputs, and we would rather not reason about which is which per
request. lib/routing.test.ts asserts the flags leave the process by reading
the outgoing request body — not by checking that the helper returns them.
The eligible upstream set is therefore dynamic and cannot be enumerated here
honestly; it is whatever currently satisfies those two constraints, and
OpenRouter publishes it. A customer who needs a fixed, named list can be given
one: VERGEML_ROUTE_ONLY pins the request to specific provider slugs, and
whatever is put in it belongs in the table above. It is empty in production
today, and that is deliberate — a hand-maintained allowlist rots quietly as
providers come and go, and a stale one fails requests.
Region is not pinned. OpenRouter has no region predicate, so "EU-only routing" would mean maintaining that allowlist. The claim this page makes is therefore zero-retention, which is enforced, and not EU residency for inference, which is not. Saying otherwise would be the easiest sentence to write and the one that fails an audit.
Transfers
The controller (the customer) and the processor (VergeLabs) are both inside the EU: the Canary Islands are an outermost region of Spain under Art. 349 TFEU and are inside the Union for data-protection purposes, whatever their position on VAT and customs. So the top-level relationship needs no transfer mechanism.
The sub-processors above in the United States do. Each is engaged under its own DPA incorporating the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) — read and confirmed for Supabase and Resend; Stripe, Vercel and Anthropic publish the same.
Changes
We will publish changes to this list here before they take effect, and give customers a reasonable period to object. Notice is by a dated entry on this page, and by email to licence holders where the change affects what data a new sub-processor reaches.