When you use GalleryLink to deliver galleries to your clients, you are the controller of your clients' personal data and we act as your processor. This page lists every third party we rely on to provide the Service, so you know exactly who is involved before you sign a data processing agreement with us.
Current sub-processors
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
| Cloudflare, Inc. | Application hosting, CDN, DNS, and edge network | Requests to gallerylink.live, including IP addresses and user-agent strings, processed transiently to serve pages and block abuse | Global edge network, including data centres in the EU |
| Supabase (Postgres) | Database for account and gallery metadata | Account email, hashed password, plan and subscription status, gallery metadata, client favorites and submitted album selections (including any name or note a client provides) | AWS ap-south-1 (Mumbai, India) |
| Google LLC (Drive API and CDN) | Source of truth for your media; serves thumbnails and downloads | The shared folder's file listing, and — because media is served directly and never proxied by us — the viewer's IP address and request metadata | Google's global infrastructure |
| Dodo Payments | Payment processing as Merchant of Record | Billing name, email, payment details, and transaction records. Card details are handled by Dodo and never reach our servers | Per Dodo Payments' own infrastructure and policies |
| Nook (usenook.live) | Support/presence widget on our marketing pages only | Page-view context for the widget on our own marketing pages. It is not loaded on client galleries | Cloudflare edge |
What we never send anywhere
Your photos and videos. GalleryLink does not store, copy, re-upload, or proxy media files — they stay in your Google Drive and are served from Google straight to the viewer. No sub-processor above ever receives a copy of your images.
Where data is stored today
Account and gallery metadata is currently stored in a database hosted in Mumbai, India. Transfers of personal data out of the EEA are made under our providers' data processing terms, which incorporate the European Commission's Standard Contractual Clauses. If EU data residency is a requirement for your studio, tell us — an EU-hosted database region is on our roadmap and we would like to know it is blocking you.
Changes to this list
We will update this page before adding or replacing a sub-processor. Customers with a signed data processing agreement can object to a new sub-processor as set out in that agreement; email gallerylinklive@gmail.com to be notified of changes directly.