QR Code AI Subprocessors
The third-party providers used by QR Code AI, with their processing purposes and data categories. This list is updated when a subprocessor is added or removed.
SUBPROCESSORS
Last updated 2 March 2026
This page lists the third-party service providers used by QR Code AI (operated by Supernovae), including subprocessors that process personal data on behalf of our customers. A provider's role depends on the processing concerned and the applicable terms. This list is maintained in accordance with our Data Processing Agreement and Privacy Policy.
We will update this page whenever a subprocessor is added or removed. The advance notification and objection arrangements for customers covered by our DPA are described under Changes to This List below.
Infrastructure and Hosting
| Provider | Purpose | Data Processed | Location |
|---|---|---|---|
| Scaleway | Primary infrastructure hosting, databases, storage, and our self-hosted PostHog analytics | Customer data, QR code assets, account data, product usage and analytics data | France (EU) |
| DigitalOcean | Secondary infrastructure hosting | Customer data, QR code assets | Netherlands (EU) |
| Cloudflare | CDN, DDoS protection, DNS, WAF | IP addresses, request metadata, cached assets | Global (US-headquartered) |
| AWS (Amazon Web Services) | Cloud services, storage | QR code assets, processed data | EU/US |
| Google Firebase | Push notifications, cloud messaging, app services | Device tokens, user identifiers | US/EU |
AI and Content Generation
| Provider | Purpose | Data Processed | Location |
|---|---|---|---|
| Anthropic | AI-powered artistic QR code generation | Text prompts, uploaded images | US |
| OpenAI | AI-powered artistic QR code generation | Text prompts, uploaded images | US |
| Replicate | Image background removal using fottoai/remove-bg-2 | Selected image submitted for background removal | US |
AI processing: We use OpenAI and Anthropic to generate artistic QR code designs from your prompts and images. For image background removal, we send only the image you select to Replicate to run the fottoai/remove-bg-2 model. OpenAI and Anthropic state that content submitted through their commercial APIs is not used to train their models by default; their policies describe exceptions for voluntary data sharing or feedback. Replicate processes the images submitted for background removal and the resulting outputs under our data processing agreement with Replicate, its service terms, and the terms applicable to the fottoai/remove-bg-2 model. These provider-specific conditions do not establish a blanket guarantee that every provider and model is subject to an identical prohibition on training. For details, see OpenAI API data controls, Anthropic commercial-data policy, and Replicate service terms.
Payments
| Provider | Purpose | Data Processed | Location |
|---|---|---|---|
| Stripe | Payment processing, subscription management, invoicing | Payment card details, billing address, email, transaction history | US/EU |
Stripe handles all payment card data directly. QR Code AI does not store credit card numbers on its own servers. Depending on the processing concerned, Stripe acts as a processor or as a data controller, including for fraud prevention and compliance with its legal obligations. See Stripe's privacy policy at https://stripe.com/privacy.
Analytics
| Provider | Purpose | Data Processed | Location |
|---|---|---|---|
| Microsoft Clarity | Behavioural analytics, heatmaps, session replays and Microsoft’s independent purposes, including advertising | Interaction data (clicks, scrolls, mouse movements), device information, IP address, user and session identifiers | EU/US |
Clarity data is not necessarily anonymous. Under the Clarity terms, Microsoft and QR Code AI act as independent controllers; Microsoft is not our subprocessor for Clarity. Microsoft collects or receives personal data for Microsoft Advertising and may also use it to provide Clarity, improve its products, measure performance and build advertising profiles. The Microsoft Privacy Statement describes its processing, retention, transfers and privacy choices. Applicable consent and opt-out requirements apply; see the cookies and privacy-rights sections of our Privacy Policy.
We also operate self-hosted PostHog analytics on the Scaleway infrastructure listed above. The analytics can be associated with account identifiers, names, email addresses, product usage, and subscription status after sign-in.
Customer Support
| Provider | Purpose | Data Processed | Location |
|---|---|---|---|
| Crisp | Live chat, customer support messaging, help centre | Name, email, chat messages, device info | EU |
Affiliate Programme
| Provider | Purpose | Data Processed | Location |
|---|---|---|---|
| Rewardful | Affiliate programme management, commission tracking | Affiliate name, email, referral data, commission amounts | US |
Changes to This List
For customers whose personal data we process on their behalf under our DPA, we will actively provide written notice of any intended addition or replacement of a subprocessor, allowing 30 days from that notice to object before the change takes effect. To object, contact us at [email protected] within that period. Updating this page supplements that notice.
For questions about our subprocessors or data processing practices, contact us at [email protected].