Purpose of This Page
This page enumerates the sub-processors currently engaged by BEY AGENCY LTD ("we", "us", the operator of AI2 Design) to deliver the Service. It exists for two reasons: (a) to give visitors and customers an unambiguous, single-source view of who processes what on our behalf without forcing them to read the full Privacy Policy or Data Processing Agreement; and (b) to satisfy enterprise procurement requirements that require a public sub-processor disclosure as part of vendor onboarding.
The full processing terms — purpose, retention, legal basis, transfer mechanism and Schrems II safeguards — live in our Privacy Policy at /legal/privacy (Section 5) and our Data Processing Agreement at /legal/dpa (Section 5). This page is a faithful summary; if there is any conflict between this page and those instruments, the Privacy Policy and DPA govern.
Active Sub-processors
- Vercel Inc. — United States
- Hosting, edge runtime, content delivery, Web Analytics (anonymous aggregated traffic — no cookies, no IP storage, no fingerprinting, daily-rotating hash for unique counts; runs always-on under legitimate interest, ePrivacy consent not required) and Speed Insights real-user monitoring (consent-gated). Frankfurt edge (fra1) for ai2.design. Public DPA: https://vercel.com/legal/dpa. Transfer mechanism: UK IDTA / EU SCC. Public sub-processor list: https://vercel.com/legal/subprocessors.
- Stripe, Inc. — United States / Ireland
- Sponsorship checkout, subscription billing, invoicing and tax calculation. Public DPA: https://stripe.com/legal/dpa. Self-certified under the EU-U.S. Data Privacy Framework (with UK Extension; verify status at https://www.dataprivacyframework.gov); additionally covered by EU SCCs and UK IDTA.
- Resend Inc. — United States
- Transactional and marketing email delivery (welcome flow, sponsor lifecycle, contact responses). EU sending region (eu-west-1). Public DPA: https://resend.com/legal/dpa. Transfer mechanism: UK IDTA / EU SCC. Sub-processor list: https://resend.com/legal/subprocessors.
- PostHog Inc. — European Union (Frankfurt)
- Product analytics. EU data residency means no international transfer. Cookieless mode (memory-only persistence), IP anonymisation, session replay disabled. Loaded only after consent. Public DPA: https://posthog.com/dpa. Sub-processor list: https://posthog.com/handbook/company/subprocessors.
- Upstash Inc. — European Union (Frankfurt instance)
- Serverless Redis store for rate-limit counters and webhook idempotency keys. EU residency. Stores only short-TTL hashed identifiers (≤24h). Public DPA: https://upstash.com/dpa. Privacy notice: https://upstash.com/privacy.
- Sentry — Functional Software, Inc. — European Union (Germany)
- Error and performance monitoring. EU data residency (de.sentry.io), session replay disabled, IP scrubbing enabled. Public DPA: https://sentry.io/legal/dpa/. Sub-processor list: https://sentry.io/legal/subprocessors/.
- Anthropic, PBC — United States
- Server-side AI inference for the optional Extractor curator brief. Receives only the public URL submitted and the resulting design tokens; no personal data is transmitted. Anthropic's standard 30-day API retention applies, after which prompts and responses are deleted on their side. Public DPA: https://www.anthropic.com/legal/dpa. Privacy policy: https://www.anthropic.com/legal/privacy. Transfer mechanism: UK IDTA / EU SCC.
International Transfer Safeguards
International transfers from the United Kingdom or European Economic Area to the United States rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (UK IDTA), the EU-U.S. Data Privacy Framework where the recipient is self-certified, or the EU Standard Contractual Clauses Module 2 (Controller-to-Processor), with supplementary safeguards as required by the Schrems II judgment of the Court of Justice of the European Union (Case C-311/18, 16 July 2020).
Each sub-processor is bound by a written agreement that imposes data protection obligations materially equivalent to those imposed on us by you under the Privacy Policy and the DPA. We remain liable to you for the performance of each sub-processor's obligations.
Notice of Changes
Material additions or replacements to this list will be reflected here and announced via the active email subscriber list at least thirty (30) days prior to taking effect, except where applicable law requires shorter notice. Customers may object to any new sub-processor by replying to the announcement email; objection initiates a written dialogue under the terms of the Sponsor Agreement or DPA.
Cosmetic changes (formatting, typo correction, version notation) do not trigger notice. The "Last updated" date at the top of this page reflects the most recent substantive update.
Contact
Questions, objections or requests for the underlying processing agreements: hi@bey.agency or hello@ai2.design.
LEGAL · SUB-PROCESSORS
Sub-processors
Active third-party service providers that process personal data on our behalf — names, jurisdictions and transfer mechanisms.
Sub-processors — document body
Acceptance notice
By subscribing to AI2 Design early-access updates, by accessing or using the Service in any capacity, or by making any payment to BEY AGENCY LTD, you acknowledge that you have read, understood, and agree to be bound by this Sub-processors. You acknowledge that you have had the opportunity to review this document with legal counsel of your choice if desired. You acknowledge that violation of this document may result in immediate suspension or termination of access, forfeiture of any amounts paid (which are non-refundable), reporting to appropriate authorities, criminal prosecution, and civil liability.