Last updated: April 21, 2026
To deliver the PlutoPro Service, Noble Nest sp. z o.o. engages the third-party sub-processors listed below. Each sub-processor processes personal data only on our documented instructions and under a written agreement that includes the protections required by Article 28 GDPR.
We review sub-processors against security, legal, and data- protection criteria before engagement and monitor their ongoing compliance. We share only the minimum data each sub-processor needs to perform its function.
Current Sub-Processors
- Legal entity
- Supabase Inc.
- Location
- Delaware, USA
- Purpose
- Managed Postgres database, authentication, and object storage
- Data categories
- Account data, product data, encrypted OAuth/SP-API credentials, generated content
- Transfer safeguard
- EU Standard Contractual Clauses (SCCs)
- Legal entity
- Vercel Inc.
- Location
- Delaware, USA
- Purpose
- Application hosting, CDN, serverless function execution
- Data categories
- Request metadata, IP addresses, application logs, inbound/outbound traffic. Vercel functions are stateless. Third-party API responses (including Amazon SP-API) transit Vercel during request/response cycles but are not persisted on Vercel infrastructure. All persistence happens in our Supabase database (encrypted at rest with AES-256, TLS 1.3 in transit).
- Transfer safeguard
- EU Standard Contractual Clauses (SCCs)
- Legal entity
- Trigger.dev Limited
- Location
- United Kingdom
- Purpose
- Background job orchestration (data ingestion, content generation, scheduled cleanup)
- Data categories
- Job payloads including product data and generation prompts
- Transfer safeguard
- UK GDPR adequacy decision (European Commission, 2021)
- Legal entity
- Anthropic, PBC
- Location
- California, USA
- Purpose
- AI text generation for product knowledge, content drafts, and learning
- Data categories
- Catalog metadata only: product titles, descriptions, attributes, brand voice context, content-generation prompts. We do not send buyer data, order data, customer PII, or seller financial data. Anthropic's commercial terms commit to no model training on submissions.
- Transfer safeguard
- EU Standard Contractual Clauses (SCCs)
- Legal entity
- Features & Labels, Inc.
- Location
- California, USA
- Purpose
- AI image generation and background removal for content composition
- Data categories
- Seller's own product images and composition prompts. We do not send buyer data, order data, customer PII, or seller financial data. fal.ai does not retain submissions after the inference call returns.
- Transfer safeguard
- EU Standard Contractual Clauses (SCCs)
- Legal entity
- Stripe Payments Europe, Ltd
- Location
- Dublin, Ireland (EEA)
- Purpose
- Payment processing and subscription billing
- Data categories
- Billing name, email, country, subscription status, payment method tokens (held by Stripe, not PlutoPro)
- Transfer safeguard
- Intra-EEA — no third-country transfer mechanism required
- Legal entity
- PostHog Inc.
- Location
- Delaware, USA
- Purpose
- Product analytics and usage measurement
- Data categories
- Usage events, feature interactions, pseudonymised user IDs
- Transfer safeguard
- EU Standard Contractual Clauses (SCCs)
- Legal entity
- Functional Software, Inc.
- Location
- California, USA
- Purpose
- Error monitoring, crash reporting, performance tracing
- Data categories
- Error stack traces, request context, user agent, account identifier
- Transfer safeguard
- EU Standard Contractual Clauses (SCCs)
Platforms that are Data Sources, not Sub-Processors
When you connect Amazon, Shopify, Etsy, or Google Drive to PlutoPro, those platforms are the source of data you authorise us to import. They are not sub-processors of Noble Nest sp. z o.o. — we do not process personal data on their behalf, nor do they process data on ours. Our use of their APIs is governed by each platform's developer agreement (including Amazon's Data Protection Policy and Google API Services User Data Policy).
Changes to this List
We may engage new sub-processors or replace existing ones. When we add or replace a sub-processor that materially affects processing of your data, we will update this page and, for significant changes, notify active customers at least 30 days in advance where practicable.
Contact
If you have questions about our sub-processors or wish to object to a new sub-processor under a signed Data Processing Agreement, contact us at support@plutopro.ai.