Subprocessors and International Transfers

Current providers

• Supabase: sign-in, database and photo storage. Processes host accounts, event content, photos, guest replies and all other records. United States.
• Vercel: hosting, content delivery and running the application. Processes every request, including IP addresses and page content in transit. United States, with servers worldwide.
• OpenAI: AI page generation and editing, and automated moderation of event text and uploaded images. Processes host instructions, page text and photos sent for generation or moderation, not guest replies. United States.
• Stripe: payment processing. Processes the payer's card and billing details and email address; we receive payment status and reference numbers. United States and worldwide.
• Cloudflare (Turnstile): bot checks on forms. Processes IP address and browser signals during a check. Worldwide.
• ImprovMX: forwards email sent to our @eventloom.co addresses to our inbox. Processes the messages you send us and their sender addresses.

Other services

Google Fonts: we use fonts from Google Fonts, but they are bundled and served from our own domain, so visitors' browsers don't contact Google. Our servers fetch font files from Google when generating share-preview images; no personal information is sent.

Not in use: we do not currently use error-monitoring, analytics, advertising or domain-registration providers. We will list any we add here first.

Transfers and changes

Eventloom is based in Canada and these providers process information outside Canada, mainly in the United States. We rely on each provider's data processing terms and transfer safeguards, such as standard contractual clauses. When we add or replace a provider we will update this page and its version number.