1.Subprocessors
These companies process personal data on our behalf to run Archetype, including personal data in your brand content. Each is bound by a data processing agreement with terms that protect the data at least as well as our DPA does. Your database, files and backups are stored in the EU, in Frankfurt.
| Subprocessor | What for | Where | Transfer safeguard |
|---|---|---|---|
| SupabaseSupabase Pte. Ltd. (Singapore), Supabase, Inc. (USA) | Database, file storage and sign-in. Holds accounts and all brand content, with backups. | EU (AWS Frankfurt, Germany). Support access and account telemetry from the USA. | SCCs in Supabase's DPA |
| VercelVercel Inc. (USA) | Hosting of the web app and API, server functions, and the headless browser that renders pages and checks. | EU (functions in Frankfurt, Germany). Requests enter at the edge location nearest the visitor. | EU-US DPF and SCCs |
| AnthropicAnthropic Ireland, Limited | AI model provider (Claude) for the AI features: descriptions, designs, edits, imports, checks and suggestions. Not used to train models. | USA and other countries where Anthropic runs inference | SCCs in Anthropic's DPA |
| TypeSafeTypeSafe AI, Inc. (USA) | Fast AI judgments on short text: ranking search results for agents, sorting colours and names read from websites and Figma, and checking copy against a brand's voice. Not used to train models. | USA | SCCs [to be signed] |
| LoopsAstrodon Corporation (USA) | Sending email: invitations, waitlist and account messages, and product updates for those who ask for them. | USA | EU-US DPF and SCCs |
| StripeStripe Payments Europe, Limited (Ireland) | Payments, subscriptions and invoices. Stripe holds card details; we never see them. | EU and USA | EU-US DPF and SCCs |
SCCs: the European Commission’s Standard Contractual Clauses. EU-US DPF: the EU-US Data Privacy Framework, for companies certified under it.
2.Services you connect
These services aren’t our subprocessors. You use them under your own agreement with them, and we only read what you ask us to.
| Service | What happens |
|---|---|
| Sign in with Google: Google tells us your name, email address and profile photo when you choose it. | |
| Figma | When you connect Figma, we read the files and libraries you pick, with your permission. |
| GitHub | When you sync from a repository, we read the public repository you name. |
The same is true of the AI tools you connect to a brand, such as Claude, ChatGPT, Cursor or Codex. What they do with what they read is governed by your agreement with their provider.
3.Files your browser loads from elsewhere
A few files in the app come straight from public content networks, so the network sees the viewer’s IP address and browser, as with any web request. No account details or brand content are sent beyond the file asked for.
| Service | What it serves |
|---|---|
| Google Fonts | Typefaces from Google Fonts, when a brand uses one. Google sees the IP address and browser of whoever views it. |
| Iconify | Icon images from the open-source icon sets a brand picks (Iconify OÜ, servers in the EU and elsewhere). |
| jsDelivr | Support files for the PDF viewer, loaded when a PDF is opened. |
| Profile photos of people who signed in with Google are shown from Google's servers. |
4.When this list changes
We tell you at least 30 days before a new subprocessor starts processing your data, by email to the owners of your brands, and we update this page and its date. If you object on reasonable data protection grounds, tell us within those 30 days at privacy@heyarchetype.com. We’ll try to find a way round it; if we can’t, you may cancel the affected plan and we’ll refund fees paid for the time after the change.
- In an emergency, such as a provider failing, we may switch first and tell you as soon as we can.
- To hear about changes without waiting for an email, write to privacy@heyarchetype.com and we’ll add you to the list.