This page lists every sub-processor with access to personal data on behalf of QR Branding, in fulfilment of our transparency obligations under Article 28 GDPR and our Data Processing Agreement.
Each sub-processor is bound by a written agreement imposing data protection obligations equivalent to our DPA. When a sub-processor changes, this page is updated at least 30 days before the change takes effect — except for security-critical replacements, which are deployed immediately and disclosed retroactively here.
To object to a sub-processor on reasonable grounds, or to receive updates by email when this page changes, write to support@qr-branding.com.
Active sub-processors
| Category | Vendor | Legal entity | Purpose | Region |
|---|---|---|---|---|
| Merchant of Record | Polar.sh | Polar Software Inc. | Billing, invoicing, tax remittance, customer refund portal. | Delaware, USA (EU-registered as MoR for EEA buyers) |
| Transactional email | Resend | Resend, Inc. | Delivery of receipts, refund links and account emails. | USA |
| CDN + edge runtime | Cloudflare | Cloudflare, Inc. | Frontend hosting (Pages), edge runtime (Workers), asset CDN, object storage (R2) and cookieless aggregate web analytics (Web Analytics). | Global (EU edge POPs serve EEA traffic) |
| Managed Postgres | Neon | Neon, Inc. | Primary database for orders, credits ledger and account state. | USA (N. Virginia, us-east-1) |
| Managed cache + rate limit | Upstash | Upstash, Inc. | Redis for cache, rate-limit counters and webhook idempotency keys. | EU (Frankfurt) |
| Serverless function host | Microsoft Azure (Functions) | Microsoft Corporation | Backend API + QR rendering engine + Application Insights telemetry. | Microsoft Azure West Europe |
| LLM provider (opt-in) | OpenAI | OpenAI, OpCo, LLC | AI generation when the end user explicitly selects OpenAI or it is the active fallback. | USA |
| LLM provider (opt-in) | Anthropic | Anthropic, PBC | AI generation when the end user explicitly selects Anthropic or it is the active fallback. | USA |
| LLM provider (opt-in) | Google Gemini | Google LLC | AI generation when the end user explicitly selects Gemini or it is the active fallback. | USA |
| LLM provider (opt-in) | Mistral | Mistral AI SAS | AI generation when the end user explicitly selects Mistral or it is the active fallback. | France (EU) |
| LLM provider (opt-in) | Cohere | Cohere Inc. | AI generation when the end user explicitly selects Cohere or it is the active fallback. | Canada |
| LLM provider (opt-in) | Groq | Groq, Inc. | AI generation when the end user explicitly selects Groq or it is the active fallback. | USA |
LLM providers — opt-in only
The third-party LLM providers above are only invoked when the end user explicitly triggers an AI generation. The specific provider used per request is selected either by the user (marketplace endpoint with the user's own key) or by an internal fallback chain (consumer credit packs). The provider used per request is logged for cost reconciliation; no email or billing data is transmitted to the provider, only the prompt and generation parameters.
International transfers
Where personal data is transferred outside the EEA (USA, Canada), the transfer relies on the EU-US Data Privacy Framework or the EU Standard Contractual Clauses (Decision 2021/914), supplemented by encryption in transit (TLS 1.2+) and at rest (AES-256).
Historical changes
No sub-processor changes since the launch of the consumer site (2026-05). When this list changes, the entry will appear here together with the effective date.