Third-party providers with whom INKOS shares personal data to operate the Platform
INKOS notifies Studios at least 30 days in advance before adding or replacing material sub-processors. Subscribe to notifications at privacy@highlabs.tech.
| Provider | Service | Data categories | Location | Transfer basis |
|---|---|---|---|---|
| Stripe Payments Europe, Ltd. | Payments & subscriptions processing | name, email, billing address, card data (via Stripe Elements) | Ireland (EU) + US | SCCs + adequacy (Data Privacy Framework) |
| Resend Inc. | Transactional email delivery | recipient email, name, email content | United States | SCCs |
| Twilio Ireland Limited | SMS delivery (booking reminders, codes) | phone number, SMS content | Ireland (EU) | GDPR — dentro do EEE |
| Google Ireland Limited | Social login (OAuth) + Google Calendar sync (opt-in) | email, name, Google ID, calendar events (when enabled) | Ireland (EU) + US | SCCs + adequacy (Data Privacy Framework) |
| Emergent (managed LLM aggregator) | Routing to AI models — Anthropic Claude, OpenAI, Google Gemini — for assistant and image-generation features | user-entered prompts (no client data by default), generated responses | United States (via underlying providers) | [REVIEW: SCCs consolidated by Emergent umbrella agreement] |
| Emergent Object Storage | Media storage (portfolio, tattoo references, session photos) | image files uploaded by studios and clients | [REVIEW: primary region — declared by Emergent] | [REVIEW: SCCs where applicable] |
| MongoDB (via Emergent-managed cluster) | Primary database (accounts, bookings, projects, clients) | all structured platform data | [REVIEW: primary region — declared by Emergent] | [REVIEW: SCCs where applicable] |
| PostHog Inc. | Product analytics (loaded ONLY after explicit "Analytics" consent in the cookie banner) | anonymous usage events, anonymised IP | United States | SCCs |