HairDraw — Subprocessors
Last updated:
Version legal-2026-10-01.2 — effective October 1, 2026
This is the current list of subprocessors that HairDraw uses to provide the Service. It is published at hairdraw.app/subprocessors and is referred to in Annex III of the Data Processing Agreement (DPA). Company names appear only on this page, not in the app.
| Subprocessor | Purpose | Data processed | Location | Safeguards |
|---|---|---|---|---|
| Google LLC (Gemini API) | Image generation for the illustrative simulations | The photo, the doctor's drawing mask and the instruction (prompt); no patient name or identifiers | United States / global | Provider data-processing terms and SCCs; no training on submitted content; retention of up to about 55 days for abuse monitoring |
| Supabase Inc. | Authentication, database and file storage (web app now; iPad and iPhone apps when full sync is available) | Clinic user accounts and Patient Data stored on the server (encrypted) | EU region | DPA and SCCs |
| Hostinger International Ltd. | Website and e-mail | Clinic contact and support messages; no Patient Data | Cyprus (EU) | DPA |
| Paddle.com Market Ltd. | Billing (when available) | Clinic billing data only; no Patient Data | United Kingdom | Acts as merchant of record under its own terms |
| Apple Inc. | App distribution (App Store) | No Patient Data | United States | Apple's developer and App Store terms |
Changes to this list
HairDraw will notify Clinics at least 30 days before adding or replacing a subprocessor, by e-mail to the Clinic and by updating this page. A Clinic may object on reasonable data-protection grounds within that period, as set out in §3.2 of the DPA.