Sub-Processors
Gardenly3D — A Service of SmartFuture AB
Last Updated: July 4, 2026
In accordance with GDPR Article 28(2) and Section 6 of our Data Processing Agreement, SmartFuture AB maintains this list of Sub-Processors that process personal data on behalf of our customers in connection with the Gardenly3D service.
SmartFuture AB will update this page with at least thirty (30) days advance notice before engaging any new Sub-Processor. If you wish to be notified of changes, you will receive a notification at the email address associated with your account.
Current Sub-Processors
| Sub-Processor | Corporate Location | Purpose | Data Processed | Processing Location | EU Transfer Mechanism | UK Transfer Mechanism |
|---|---|---|---|---|---|---|
| Supabase, Inc. | San Francisco, USA | Database hosting, authentication, file storage | User accounts, project data, uploaded files | EU (Stockholm, Sweden — AWS eu-north-1) | EU processing; SCCs as backup | Processing in EU — no UK transfer required; IDTA as fallback |
| Sinch AB / Mailgun Technologies | Stockholm, Sweden | Transactional email delivery (account verification, notifications, password resets) | Email addresses, email content | EU | EU processing (Sinch is headquartered in Sweden) | Processing in EU — no UK transfer required |
| Stripe Payments Europe, Ltd. | Dublin, Ireland | Payment processing, billing, invoicing, fraud detection | Name, email, billing address, payment method metadata (SmartFuture AB does not receive or store raw card numbers) | EU (Ireland) / US | EU-US Data Privacy Framework (DPF); SCCs as backup | UK-US Data Bridge (Stripe certified); EU SCCs + UK Addendum as fallback |
| Vercel, Inc. | San Francisco, USA | Application hosting, deployment, edge delivery | IP addresses, request metadata, session data | EU (Frankfurt, Germany) / Global CDN edge nodes | EU-US Data Privacy Framework (DPF) where applicable; SCCs as backup | UK-US Data Bridge where applicable; EU SCCs + UK Addendum as fallback |
| Replicate, Inc. | San Francisco, USA | AI image generation and AI image-verification features | Design renders, scene descriptions, prompt data, generated images | US | Standard Contractual Clauses (SCCs) | EU SCCs + UK Addendum, or IDTA |
| OpenAI, L.L.C. | San Francisco, USA | Plant visual-profile generation | Plant genus taxonomy prompts and generated visual-profile data; no user, account, or project data | US | DPF where applicable; SCCs as backup | UK-US Data Bridge where applicable; UK Addendum/IDTA as fallback |
| Cloudflare, Inc. | San Francisco, USA | Object-storage backups, CDN, DDoS protection, edge routing | Backups of Service data, request metadata, IP addresses | EU / Global edge network / US | DPF where applicable; SCCs as backup | UK-US Data Bridge where applicable; UK Addendum/IDTA as fallback |
| SiteGround Spain S.L. | Madrid, Spain | Support email hosting and mailbox services | Support communications, email addresses, message metadata | EU | EU processing | Processing in EU — no UK transfer required |
Infrastructure Sub-Processors
These providers operate as sub-processors of the Sub-Processors listed above and do not have a direct contractual relationship with SmartFuture AB:
| Sub-Processor | Used By | Purpose | Processing Location |
|---|---|---|---|
| Amazon Web Services (AWS) | Supabase | Cloud infrastructure for database and storage hosting | EU (Stockholm, eu-north-1) |
| Amazon Web Services (AWS) | Cloudflare R2 / infrastructure providers | Cloud infrastructure for object storage and backups | EU / Global |
How We Minimize Data Transfers
SmartFuture AB has configured its Sub-Processors to process data within the EU wherever possible:
- Database (Supabase): Hosted in Stockholm, Sweden (AWS eu-north-1) — no transfer outside the EU for stored data
- Email (Mailgun/Sinch): EU processing region enabled — email processing occurs in EU data centers
- Payments (Stripe): EU payments processed through Stripe's Irish entity; some fraud detection processing may occur in the US under DPF
- Hosting (Vercel): Serverless functions configured for EU (Frankfurt); static assets served via global CDN (IP addresses may be processed at edge nodes worldwide)
- AI rendering (Replicate): Used only when AI image features are requested; consider prompts and renders transferable to the US
- Plant profiles (OpenAI): Used for plant visual-profile generation from genus taxonomy prompts that contain no user, account, or project data
- Backups/CDN (Cloudflare): Used for object-storage backups and edge protection; global edge processing may occur
- Support email (SiteGround): EU-hosted support mailbox processing
Other Recipients
When you use address or place search, the Service sends the search query through our server-side geocoding proxy to Nominatim/OpenStreetMap to return matching map locations. Address queries may be personal data. Nominatim/OpenStreetMap is used as a geocoding recipient, not as primary account or project storage.
UK Users
For controllers established in the United Kingdom, transfers of personal data from the UK to third countries are governed by the UK International Data Transfer Agreement (IDTA, effective 21 March 2022), EU Standard Contractual Clauses supplemented by the ICO's UK Addendum, or another valid UK transfer mechanism as noted in the table above. SmartFuture AB will periodically verify applicable transfer mechanisms for US-based Sub-Processors. If a certification or adequacy mechanism does not apply or lapses, the UK Addendum/IDTA mechanism applies as fallback where available.
See DPA Section 17 for full UK Controller provisions.
Objecting to a Sub-Processor
If you object to a new Sub-Processor, you may notify us within thirty (30) days of receiving the change notification. Please send your objection, including data protection-related grounds, to hello@gardenly3d.com. See DPA Section 6.2 for the full objection procedure.
Contact
Data Protection Contact: hello@gardenly3d.com
SmartFuture AB Organisation number: 559433-4954 SciencePark, Gjuterigatan 9 553 18 Jönköping, Sweden