Sub-Processor List

This Sub-Processor List identifies third-party providers (“Sub-processors”) that Fipera Trading F.Z.E (“Fipera”, “we”, “us”, “our”) engages to process personal data on behalf of customers using the neo-fashion.ai platform (“Service”).

This list supplements our Privacy Policy and Data Processing Agreement. Enterprise customers may subscribe to change notifications by contacting legal@neofashion.ai.

Last updated: May 2026 · Version: 1.0

1. How we use Sub-processors

Sub-processors provide infrastructure, AI generation, payments, email delivery, monitoring, and security services. Fipera remains responsible for selecting Sub-processors with appropriate safeguards and imposing contractual data protection obligations.

We do not authorise Sub-processors listed below to use customer content to train public models for their own products, except as explicitly disclosed in their enterprise terms and our agreements with them.

2. Current Sub-processors

Sub-processor	Function	Data processed	Primary location(s)	Trains on customer data?
Supabase	Database, authentication, object storage, Edge Functions	Account data, workspace content, generation metadata, session tokens	United States, EU (region-dependent)	No (per Supabase enterprise terms)
Google Cloud / Google AI	Gemini, Imagen, and Veo APIs for text, image, and video generation	Prompts, uploaded images, generation parameters	United States, EU (configurable)	No for API data under Google Cloud AI terms
fal.ai	Image, video, and LoRA model training APIs	Training images, prompts, model artifacts	United States, EU	No for customer training jobs under fal.ai terms
Stripe	Payment processing, subscription billing, fraud prevention	Billing name, email, payment method metadata, transaction records	United States, EU	No
SendGrid (Twilio)	Transactional email (confirmations, password reset, billing notices)	Email address, name, message content	United States	No
Vercel	Marketing site and application hosting, edge delivery, serverless functions	IP address, request logs, deployment metadata	United States, EU	No
Sentry	Application error monitoring and performance	IP address, device/browser info, stack traces (PII minimised)	United States, EU	No
Cloudflare	DNS, CDN, DDoS protection, and edge security (where enabled)	IP address, request headers, security logs	Global edge network	No

Notes

• Google services may include Gemini Pro Image, Gemini Flash, Imagen 4, and Veo depending on module configuration.
• fal.ai is used for default custom model (LoRA) training workflows.
• Actual processing locations may depend on your workspace configuration, enterprise data residency options, and provider region settings.

3. Categories of data shared

Category	Typical Sub-processors
Account and authentication	Supabase, SendGrid
Customer Content (images, prompts)	Supabase (storage), Google, fal.ai
Generated Output	Supabase (storage), Google, fal.ai
Billing	Stripe
Operational logs	Vercel, Sentry, Cloudflare

Customer Content may transit Sub-processor networks only as necessary to perform the requested generation or storage operation.

4. Changes to this list

4.1 We update this page when we add or replace a Sub-processor that processes personal data.

4.2 For enterprise customers subject to a DPA, we provide notice of material Sub-processor changes as described in the DPA. Objections may be raised on reasonable data protection grounds within the period stated in the DPA.

4.3 Immaterial changes (corporate renaming, subsidiary restructuring without processing change) may be updated without separate notice.

5. Security and transfers

Sub-processors are selected based on security practices, contractual commitments, and operational necessity. Where personal data is transferred internationally, Fipera implements appropriate safeguards as described in the DPA and Privacy Policy.

6. Contact

Questions about Sub-processors or data processing:

Email: privacy@neofashion.ai
Enterprise / DPA: legal@neofashion.ai

See also: Security · Privacy Policy · Data Processing Agreement