Mosawer
Log in

Sub-processors

Last updated {EFFECTIVE_DATE}.

Some of the work behind Mosawer is done by companies we contract with. They process personal data only on our instruction and only for what we ask. This page lists every one of them, what they do, and where they do it. It is the list our Privacy policy refers to, and it is part of that policy.

1. What counts as a sub-processor

A sub-processor is a company that can, in the course of doing its job for us, touch personal data belonging to you or to a photographer's guests. Something we merely buy and run ourselves is not on this list, because nobody else sees the data: the database, the queue, the realtime server and the face-recognition service all run on machines we rent, and no third party is given access to them.

We do not sell personal data to anyone, and none of the companies below is allowed to use it for their own purposes.

2. Hosting and storage

  • Hetzner Online GmbH, Germany. Our servers and our database run here, in a data centre in Falkenstein. This is where the account records, the album records and the face templates live.
  • Cloudflare, Inc., United States. Serves every page and photograph through its network, provides the domain names and the protection in front of our servers, and stores the photograph files themselves in Cloudflare R2. Our storage bucket is located in Eastern Europe.

3. Payments

  • Polar Software Inc., United States. Takes subscription payments from photographers and is the merchant of record for them. Receives the billing details you enter at checkout. We never see or store a card number.
  • Whop Inc., United States. Handles payments in a photographer's store and the payouts to that photographer. Receives a buyer's payment and contact details for the order. Again, no card number reaches us.

4. Email

  • Resend, United States. Sends the email the product sends: sign-in codes, password resets, gallery invitations, the Find Me notifications a guest asks for, and receipts. It receives the recipient's address and the content of that message.

5. Signing in

  • Google LLC, United States. Only if you choose "Continue with Google". Google tells us your name, your email address and that the sign-in succeeded. If you sign in with an email and a password instead, Google receives nothing.

6. Measurement and error reporting

  • PostHog, United States. Product analytics: which pages are opened and which features are used, so we can see what is worth building. It receives an account identifier, never a name or an email address.
  • Sentry (Functional Software, Inc.), United States. Error reporting. When something breaks it receives the technical details of the failure so we can fix it. It is configured not to record sessions and not to store your IP address.

7. Processing outside Saudi Arabia

All of the companies above process data outside the Kingdom, in Germany, the United States or the European Union, and so do we. This is described in the Transfers section of our Privacy policy, which is where the safeguards are set out. If you would rather your data were not processed abroad, the honest answer is that Mosawer is not able to offer that today.

8. Changes to this list

We update this page when a company is added or removed, and the date at the top changes with it. A photographer who has a written agreement with us and wants notice in advance of a change should write to us and we will give it.

9. Contact

Questions about anyone on this list go to [email protected]. You do not need an account to write to us.