Sub-processors
The third-party service providers we use to operate the FramesOnDemand service. Each receives only the data needed to perform its specific role, under a data processing agreement that limits use to what's necessary for the service.
Effective date: April 30, 2026 · Last updated: April 30, 2026
Current sub-processors
| Sub-processor | Role | Location |
|---|---|---|
| Cloudflare | File storage (R2) for print files, mockup images, and exports. Encryption at rest. Also CDN and DNS for the marketing site. | Global |
| Stripe, Inc. | Payment processing and billing. Stores card data; we hold a tokenized reference (Stripe Customer ID). | United States |
| Resend | Transactional and operational email delivery. Order confirmations, invoices, dunning notices, GDPR exports. | United States |
| Shopify Inc. | Platform integration. OAuth, webhook delivery, order ingestion for Shopify-installed sellers. | Canada / United States |
| Vercel Inc. | Web application and embedded admin hosting. | United States |
| Neon | PostgreSQL database hosting. | United States |
| ShipStation (Auctane) | Shipment management, label generation, carrier rate calculation, tracking. | United States |
| Google Analytics 4 | Anonymized marketing-site analytics. Aggregated visitor metrics, no individual user tracking. | Global |
| Anthropic PBC | AI features (planned, not yet integrated). Listed in advance per our change-notification commitment below. | United States |
How we notify you of changes
We add new sub-processors only when needed to operate the service. When a new sub-processor is added, we update this page and notify active sellers by email at least 14 days before the new sub-processor begins processing personal data on our behalf.
If you object to a new sub-processor, contact privacy@custompictureframes.com and we will work with you to find a path forward (typically: pause the change for your account, or terminate the affected service area without penalty).
A note on CustomPictureFrames LLC
CustomPictureFrames LLC is the legal entity operating the FramesOnDemand service, not a third-party sub-processor. The CPF production facility in New Jersey receives order data and customer shipping addresses to print, frame, pack, and ship orders on the seller's behalf. This is internal processing within the same legal entity, governed directly by our Privacy Policy.
Historical sub-processors
None. This is the inaugural list. As the service evolves, prior sub-processors may be removed; we maintain a record here for audit transparency.
Subscribe to change notifications
Active sellers receive email notification of sub-processor changes at the contact email on file with the FramesOnDemand app. Non-sellers (auditors, prospective customers, regulators) can request notification by emailing privacy@custompictureframes.com with subject "subscribe to sub-processor changes."
We do not maintain a public mailing list for change notifications. The list above is the canonical source of truth and is updated within 24 hours of any addition or removal.
Questions
For questions about a specific sub-processor's role, security posture, or sub-processing agreement, contact:
- Email: privacy@custompictureframes.com
- Postal: CustomPictureFrames LLC, Attn: Privacy, 6 Shirley Ave, Somerset NJ 08873, USA
For the full data-handling and privacy framework that governs how we use these sub-processors, see our Privacy Policy.