Unterauftragsverarbeiter

legal & privacy · Updated 28 July 2026

TAILORED. Systems uses the following sub-processors to deliver the service. Most infrastructure is located within the EU/EEA. On-model image generation is currently performed by FASHN. The New Black is the planned successor provider; its processing locations and transfer safeguards must be legally resolved (Legal Gate KLE-376) before it is activated for production traffic. We provide at least 30 days' notice before adding or replacing a sub-processor.

Sub-processorPurposeRegion

Appwrite Cloud (EU region)Authentication, database, and file storageGermany (EU) — no transfer

FASHN (api.fashn.ai)Garment-on-model image generation — currently the active provider for new and existing jobsUnited States; transfer safeguarded by EU Standard Contractual Clauses

The New Black (thenewblack.ai / Bubble.io)Garment-on-model generation — planned successor provider; not yet processing production trafficProcessing location and transfer safeguards must be legally resolved before activation (Legal Gate KLE-376)

Stripe Payments EuropeSubscription and payment processingIreland (EU entity) with global infrastructure; transfer safeguards require legal review before processing

SentryError and performance monitoringEU data region

Hetzner Online GmbHCompute and image storageGermany (EU) — unverified, pending review

PostmarkTransactional e-mail deliveryGermany (EU) — unverified, pending review

Change notification

We will notify you by e-mail at least 30 days before adding a new sub-processor or replacing an existing one. You may object to a new sub-processor by contacting privacy@tailored.systems within the notice period. If you object and we cannot accommodate your objection, you may terminate the relevant services by providing written notice.

Data transfers

Most sub-processors listed above operate infrastructure within EU/EEA member states. FASHN's US transfer is safeguarded by EU Standard Contractual Clauses. The New Black is the planned successor provider; its processing location and transfer safeguards must be legally resolved (Legal Gate KLE-376) before it is activated for production traffic. Before processing, each sub-processor must meet the requirements of Art. 28 GDPR.

Security requirements

Each sub-processor is required to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Art. 32 GDPR. Sub-processors are contractually obligated to process personal data only for the specified purpose and to delete data upon termination of the agreement.

Contact

Questions about this sub-processor list should be directed to privacy@tailored.systems.