Last updated: July 2026
This policy text is provided for operational launch and requires independent legal review before final sign-off.
We use the following third-party sub-processors to deliver Spinney. Each is bound by appropriate data processing terms. We update this list when vendors that process personal data are added or removed.
| Vendor | Purpose | Data location |
|---|---|---|
| Stripe | Payment processing, payouts, and Stripe Identity (where enabled) | US / EU (SCCs) |
| Clerk | Authentication and session management | US (SCCs) |
| Google (Analytics & Maps) | Website analytics (with consent) and map/location services | US / EU (SCCs) |
| Google Gemini | Admin-only AI drafting for email templates and newsletters | US / EU (SCCs) |
| Gmail API / SendGrid | Transactional and marketing email delivery | US (SCCs) |
| Hostinger VPS | Application hosting and infrastructure | EU (UK) |
| Redis | Caching, rate limiting, and session acceleration | EU (co-located with application) |
Questions about international transfers or processing agreements? Contact our DPO at dpo@spinney.app or see the Privacy Policy.