Subprocessors
The third parties that process data on our behalf, what each one receives, and where it runs.
Only one of them — our hosting provider — ever holds an uploaded image or a face embedding. The database, object storage, cache, authentication service and the models themselves all run on our own servers rather than a managed service, which is why this list is shorter than you might expect.
| Subprocessor | Purpose | What it receives | Where |
|---|---|---|---|
| Contabo GmbH | Infrastructure and hosting | Everything. Application servers, the Postgres database, uploaded images, face embeddings and backups all run on machines we rent here. | Germany and the Netherlands (EU) |
| Dodo Payments | Payments, acting as Merchant of Record | Name, email, billing address, tax identifiers and card details. Card numbers are entered on their checkout and never reach our systems — we receive the card brand and last four digits. | United States, with EU processing for EU customers |
| Amazon Web Services | Transactional email delivery (SES) | Recipient name and email address, and the contents of the message — a payment receipt, a usage warning, a password reset. | United States (us-east-1) |
| Google LLC (Google Analytics) | Website analytics | Which pages are visited and in what order, an approximate location derived from your IP address, your device and browser, and a randomly generated identifier held in a cookie. It is not joined to your account, and no uploaded image, extracted text or face data is sent to it. | United States, with EU collection endpoints for EU visitors |
| Microsoft Corporation (Clarity) | Heatmaps and session recordings of the marketing pages | How pages on this site are scrolled and clicked, recorded as page structure and pointer movement, with your device, browser, approximate location and a random identifier held in a cookie. Signed-in pages, sign-in and onboarding are never recorded, and the live demo on each product page is masked — so no uploaded photo, face, extracted text or account detail is captured. | United States |
| Google LLC / GitHub, Inc. | Optional single sign-on | Only if you choose to sign in with one of them, and only the identity they assert: your email address, name and avatar. Sign in with a password and neither is involved. | United States |
What we do not use
No advertising service runs on this site. Google Analytics and Microsoft Clarity do, and both are listed above. Clarity records how the public pages are scrolled and clicked; it never runs once you are signing in or signed in, and the live demo panel is masked, so nothing you upload is captured by either. We do not use a third-party error-monitoring service in production. We do not send customer data to any model provider — the face and document models are ours and run on our own hardware, so nothing you upload is used to train anyone else's system, including ours.
Changes to this list
Email privacy@quantilence.com and we will tell you before we add a subprocessor that would handle your data, with enough notice to object. See also our security practices and privacy policy.