Subprocessors and service providers
Cargos3D uses specialized providers for specific technical functions. Not every provider receives every category of data and access is limited to what is needed for the relevant service.
Last updated: 10.08.2026
1. Core providers
Supabase
- Service
- Core backend infrastructure - database, authentication, storage and server functions.
- Data
- Account and organization data, customer content, cargo and plan data, files and technical records depending on the functions used.
Stripe
- Service
- Checkout, payments, subscriptions and related billing.
- Data
- Email and billing identifiers, selected plan, payment and subscription status, transaction and billing data. Full card details are normally entered directly with Stripe.
Netlify
- Service
- Public web application hosting, CDN, deployment and edge routing.
- Data
- Network and request data such as IP address, headers, URL, country for geo routing and technical logs needed to deliver and protect the site.
Resend
- Service
- Delivery of transactional and business email messages.
- Data
- Recipient email address, message metadata and the content needed for the specific message.
ipapi
- Service
- Limited country-detection fallback when geo information from the hosting infrastructure is unavailable.
- Data
- IP address and country result. Cargo plans, customer content and payment data are not sent for this function.
Google Fonts
- Service
- Web font delivery on the public website.
- Data
- Standard browser request data that may include an IP address and technical headers. This is not a store for Cargos3D account or cargo data.
Listed for transparency as a public web resource provider. Its role is not necessarily the same as a subprocessor handling customer content on behalf of Cargos3D.
2. International transfers
Some providers or their subprocessors may process data outside the European Economic Area. Where applicable law requires an additional transfer mechanism, Cargos3D relies on the mechanisms available under the relevant contractual arrangements, for example an adequacy decision, the EU-US Data Privacy Framework for certified recipients or Standard Contractual Clauses.
The specific processing location may depend on service configuration, the selected infrastructure region and the provider’s own subprocessors. For a specific enterprise or procurement scenario, contact us at sales@cargos3d.com.
3. Provider changes
We may add, replace or remove providers as the service evolves. This page is updated to reflect the main current providers. Where the DPA or applicable law requires notice of a material subprocessor change, we will use a reasonable notice channel and provide a reasonable opportunity to raise a substantiated data protection objection.