Sub-processors

To run Starkie Teams we rely on a small number of other companies — sub-processors — that process personal data on our behalf: to store photos, train the image model that generates a member's headshots, send the emails that come with a shoot, host the application and tell us when something breaks. This page is the current list. It is Annex B of our Data Processing Addendum, which incorporates it by reference, so the list a customer signs up to and the list we actually use are the same one.

What we require of them

Each sub-processor is bound by a data processing agreement with obligations equivalent to those we owe our customers, and we remain responsible to the customer for the work they do. Several of them, including the providers that handle member photos, process data in the United States: those transfers are covered by the European Commission's Standard Contractual Clauses together with the measures described on our security page. Starkie Teams is not an EU-only service, and we would rather say so plainly than imply otherwise.

We give each provider only the data it needs. Astria receives the selfies and the prompts required to train a private model and generate images, and the trained model is deleted on the retention schedule. Resend receives an email address and the text of a message, never a photograph. Sentry receives error diagnostics, not member images.

How we choose them

We keep the list short on purpose: every additional provider is another place personal data can sit. Before adding one we check that it offers a data processing agreement and a transfer mechanism we can rely on, that it can be scoped to the data the feature actually needs, and that we can delete data from it on request — the deletion a member asks for has to reach every copy, not just ours. Storage sits in Amazon S3 in the us-west-1 region; application hosting and the edge network run in both United States and European regions.

Changes to this list

We announce any new or replacement sub-processor to organisation administrators by email at least 30 days before it starts processing personal data, and we update this page at the same time. If your organisation objects on reasonable data protection grounds within that window, you may terminate the affected part of the service under the addendum. Questions, or a request to be added to the notification list for a particular address, go to privacy@starkie.ai.

Current sub-processors

The list below shows what each provider does, the region it processes data in, and a link to its own data processing terms.