Sub-Processors
Last updated: May 8, 2026
Gaze uses the following sub-processors to provide the Service. This list is maintained in accordance with our obligations under the General Data Protection Regulation (GDPR) and our Data Processing Agreement.
Current Sub-Processors
| Sub-Processor | Legal Entity | Location | Purpose | Data Processed |
|---|---|---|---|---|
| Supabase | Supabase, Inc. | United States | Postgres database hosting, user authentication, file storage (private buckets), realtime channels | Account data, profile data, event data, media files (photos, videos, GIFs, boomerangs), authentication tokens, kiosk PIN hashes |
| Vercel | Vercel, Inc. | United States | Application hosting, edge runtime, build pipeline, request and runtime logs | HTTP request metadata (IP, user-agent, path), runtime logs, deployment metadata |
| Google LLC | United States | OAuth sign-in (optional alternative to email + password) | Email, name, profile picture (only if a user chooses Google sign-in) | |
| hCaptcha | Intuition Machines, Inc. | United States | Bot prevention during signup and other rate-limited flows | Captcha challenge tokens, IP address (collected by hCaptcha directly) |
| Microsoft | Microsoft Corporation | United States | Session replay analytics via Microsoft Clarity (loaded only on the marketing site and the organizer / publisher dashboards — never on guest-facing pages); Clarity also synchronizes a Bing UET pixel (c.bing.com) for cross-property analytics | Anonymized interaction data, page URLs, device/browser info, click and scroll telemetry, masked DOM recordings |
| Resend | Resend, Inc. | United States | Transactional email delivery, configured as the SMTP provider behind Supabase Auth (magic links, password resets, email verification, account notifications) | Email address, email content, message metadata |
| Sentry | Functional Software, Inc. | United States | Error monitoring and session replay (organizer-facing pages only — not loaded on guest-facing pages) | Error events, stack traces, anonymized session recordings (tracesSampleRate: 0.1, replaysSessionSampleRate: 0.1, replaysOnErrorSampleRate: 1.0) |
| Stripe | Stripe, Inc. | United States | Payment processing, subscription billing, hosted Checkout, Customer Portal, one-off event-credit purchases | Email address, name, billing address (collected by Stripe directly), Stripe customer ID, subscription status, event-credit purchase history (Stripe handles full card data directly — Gaze never sees or stores card numbers) |
A note on Sentry Session Replay
Sentry's Session Replay feature is enabled in production on organizer-facing pages only and is not loaded on guest-facing pages. It captures a privacy-respecting recording of user interactions to help us debug errors. By default Sentry masks user input and media content; we have not added additional content scrubbing beyond Sentry's defaults. Session Replay records on 10% of organizer-facing sessions and on 100% of organizer-facing sessions that experience an unhandled error. If you would prefer not to be recorded, you can disable Session Replay by blocking the Sentry SDK at the network layer (for example via a browser extension that blocks *.sentry.io and *.sentry-cdn.com); this will not affect the Service's functionality.
We are actively working with our infrastructure provider to add additional PII scrubbing in the beforeSend hook; updates will be reflected here.
Hosting and infrastructure dependencies (not personal-data sub-processors)
The following providers receive non-personal data only or are used at build time / network-layer only and are therefore not listed as personal-data sub-processors:
- Cloudflare (DNS resolution, CDN edge for some assets) — receives only the DNS lookup and TLS handshake metadata you would send to any HTTPS host.
- Google Fonts — Gaze self-hosts web fonts via Next.js's font pipeline at build time; end-user browsers do not make requests to
fonts.googleapis.comorfonts.gstatic.comwhile loading the Service.
Changes to Sub-Processors
We will notify event organizers by email at least 30 days before adding a new sub-processor. During this period, organizers may object to the addition by contacting us at support@gaze.photo. If an organizer objects and we cannot reasonably accommodate the objection, the organizer may terminate their use of the Service.
We will update the "Last updated" date on this page whenever a sub-processor is added, removed, or changed.
Questions
If you have questions about our sub-processors or data processing practices, please contact us at support@gaze.photo or by mail to Terena Group LLC, 418 Broadway, Ste N, Albany, NY 12207, United States.