StoryForge Pledges
Sub-processor List
Effective 2026-06-28
The third-party providers we use to deliver StoryForge Pledges. We give 30 days' notice before adding a new one — see the DPA for your right to object.
Current sub-processors
Each row below shows what the provider does for us, what data they handle, where they are located, and a link to their own data-protection commitments. We sign a Data Processing Agreement (or equivalent) with every provider before sharing personal data.
Vercel Inc.
Application hosting + serverless compute
Data handled
All platform traffic (TLS-terminated). No backer data stored at rest.
Primary location
United States (with global edge)
Their DPA
Supabase Inc.
Primary database + file storage
Data handled
Creator account data, campaign metadata, backer personal data, reward assets.
Primary location
United Kingdom (eu-west-2)
Their DPA
Clerk Inc.
Identity provider (creator authentication)
Data handled
Creator name, email, password hash, session tokens. No backer data.
Primary location
United States
Their DPA
Stripe Payments UK Ltd
Payment processing for backer charges
Data handled
Backer name, billing address, last 4 of card. Full card numbers never touch our servers.
Primary location
United Kingdom + Ireland
Their DPA
Resend Inc.
Transactional email (surveys, receipts, notifications)
Data handled
Backer name, email, message body. Retained 30 days for delivery diagnostics.
Primary location
United States
Their DPA
Cloudflare Inc.
DNS + DDoS protection in front of Vercel
Data handled
Connection metadata only (IP, user-agent). No request bodies stored.
Primary location
United States (with global edge)
Not sub-processors
For clarity, these third parties are not sub-processors of StoryForge Pledges, even though they may interact with you:
- Kickstarter PBC — the source platform you import data from. We do not share any data with Kickstarter; we only read from it (with your authorisation) or accept uploads from you.
- Your fulfilment provider (e.g. a printer, a shipping warehouse, ShipStation) — when you export data to them, you are sharing it as a controller, not via us.
- Your accounting / tax software — same as above.
Get notified of changes
Subscribe to the RSS feed at /legal/sub-processors/rss (coming soon), or to be added to a notification list. The commit history of this page in our public source repository is the canonical audit trail.