Subprocessors & Service Providers
The third parties that help us run Viewdora, what each one does, and what role it plays.
Last Updated: October 2, 2026
Forged Concepts LLC, doing business as Viewdora, uses the providers below to operate the Services. This page is referenced by our Privacy Policy, our Terms of Service, and our Data Processing Addendum, and it is the list we maintain for the purposes of the DPA’s subprocessor provisions.
Roles. A processor (or “service provider”) handles personal information only on our documented instructions. Where we are a photographer’s processor, these providers are that photographer’s subprocessors. An independent controller decides for itself how to use certain information, under its own terms and privacy notice.
Notice of changes. We update this page when we add or replace a provider that handles personal information. Photographers can subscribe to notifications by emailing hello@viewdora.com with “Subprocessor Notifications” in the subject line, and we will give at least 30 days’ advance notice of a new subprocessor to everyone who has subscribed. Objections are handled as described in Section 6 of the Data Processing Addendum.
Processors and subprocessors
| Provider | What it does for us | Personal information involved | Processing location |
|---|---|---|---|
| Amazon Web Services | Hosting, application servers, databases, file storage, content delivery, and backups. This is where photographs and account data live. | All categories, including photographs and Client Data. | United States |
| Stytch | Authentication: magic links, one-time codes, and session management. | Email address, session and device information, sign-in events, IP address. | United States |
| Stripe | Payment processing, subscription billing, invoices, and the billing portal. Also acts as an independent controller for payments and fraud prevention (see below). | Name, email, billing address, payment method, transaction records. | United States and other countries where Stripe operates |
| PostHog | Product analytics, session replay, and error monitoring across the website, Studio, and the mobile apps. Routed through our own domain s.viewdora.com. | Analytics identifiers, account email, product events, page and screen paths, device and browser information, approximate location from IP, session recordings with on-screen text, images, and form inputs masked. | United States (PostHog US Cloud) |
| Google — Google Analytics | Website measurement on viewdora.com, and sign-in and sign-up measurement on the Studio sign-in and sign-up pages (the sign-in page, the one-time code page that follows it, and the sign-up page), in each case after you accept analytics cookies. It never loads on gallery pages, Client download pages, or anywhere else in the signed-in app. IP anonymisation is enabled. Google Signals is on, so once you accept analytics Google may associate measurement data with your Google account (see Cookie Policy Section 2). Advertising storage and advertising user data are granted only for Google Ads, below, and only after you accept advertising cookies. Ad personalization stays denied, so we do not use Google for remarketing. | Analytics cookie identifiers, page views, a sign_up event when a Studio account is created, referrer, campaign parameters, device and browser information, approximate location. | United States and other countries where Google operates |
| Google — Google Ads | Conversion measurement for our Google ads on viewdora.com and on the Studio sign-in and sign-up pages. The tag loads before you choose, in Google Consent Mode with advertising storage denied, so until you accept advertising cookies Google receives only cookieless pings with the ad click identifier redacted. If you decline, or your browser sends a Global Privacy Control or Do Not Track signal, Google Ads receives nothing. It never loads on gallery pages, Client download pages, anywhere else in the signed-in app, or in the mobile apps. Ad personalization (remarketing) is not enabled. Google uses this data as described in its own privacy policy, which U.S. state privacy laws may treat as “sharing”; opt out the same way as for the Meta Pixel below. | Page views, a sign_up event when a Studio account is created, the ad click identifier and first-party _gcl_* browser identifiers, IP address, device and browser information. No photographs, gallery content, Client Data, or account email is sent. | United States and other countries where Google operates |
| Google — Firebase Crashlytics | Crash and diagnostic reporting for the iOS and Android apps. | Crash traces, exception messages, device model, OS version, app version, timestamps, Crashlytics installation identifier. | United States and other countries where Google operates |
| Brevo | Transactional and marketing email delivery. We also sync contact lists to Brevo: account owners, team members, and the clients photographers add to galleries. The client list is used for Viewdora’s own messages as well as photographer-directed mail — see Section 10 of the Privacy Policy and Section 4 of the DPA, including how a photographer switches that off. | Name, email address, message content, delivery and engagement records, and list membership. | European Union |
| Freshworks (Freshdesk) | Help-desk and support ticketing at support.viewdora.com. | Name, email address, ticket content and attachments you send us. | United States (Freshworks US data center) |
| Web3Forms | Delivers submissions from the contact form and the Ambassador application form on viewdora.com to our inbox. | What you type into the form: for the contact form, name, email address, subject, and message; for an Ambassador application, name, email addresses, country, website or social links, audience description, and your eligibility confirmations. | United States (AWS US-East). Submissions are forwarded to our inbox, not stored. |
| Rewardful | Referral and affiliate tracking, attribution, and commission calculation for the Referral & Ambassador Program. | Referral identifiers, campaign and click data, referred-customer email and subscription amounts from Stripe, ambassador contact and payout details. | United States (hosted on Heroku, running on AWS) |
Other recipients
These parties are not our processors. They decide for themselves how to use the information they receive, under their own terms.
| Recipient | Context | Role |
|---|---|---|
| Stripe | As a regulated payment institution: payment processing, fraud and risk decisions, and its own legal and compliance obligations. | Independent controller |
| Meta Platforms | The Meta Pixel on viewdora.com and on the Studio sign-in and sign-up pages, which measures our Facebook and Instagram advertising. Receives page views, a CompleteRegistration event when a Studio account is created, the page and referring addresses, IP address, browser user agent, and a first-party _fbp browser identifier — only from the moment you accept advertising cookies, and never from any other Studio page, a gallery, or the mobile apps. No photographs, gallery content, Client Data, or account email is sent. Meta uses it for its own advertising purposes, which U.S. state privacy laws treat as “sharing” for cross-context behavioural advertising; opt out at Cookie Preferences on viewdora.com, or through the Studio cookie banner, the Cookie preferences link on the Studio sign-in and sign-up pages, or your Studio account settings. | Independent controller |
| Apple | App Store distribution, app analytics and crash data at the store level, and any purchase made through the store. | Independent controller |
| Google Play | Play Store distribution, app vitals, and any purchase made through the store. | Independent controller |
| PayPal | Paying ambassador commissions. PayPal is the only payout method. | Independent controller |
| Professional advisers and authorities | Accountants, auditors, insurers, and lawyers under confidentiality obligations; regulators, courts, and law enforcement where a valid legal request requires it. | Independent controllers |
What we require of them
- a written agreement with data-protection terms, for every provider that processes personal information on our behalf;
- processing limited to our documented instructions, with confidentiality obligations on their personnel;
- appropriate technical and organisational security measures;
- support for deletion or return of data at the end of the engagement; and
- an appropriate transfer mechanism where personal data leaves the EEA, the UK, or Switzerland — see Section 8 of the Privacy Policy.
Where a row above says confirmation is in progress, we have not yet finished documenting that provider’s processing region for publication. Ask us at hello@viewdora.com and we will tell you the current position rather than guess on this page.
Last Updated: October 2, 2026. Questions: hello@viewdora.com · Forged Concepts LLC, 4680-18 I Monticello Ave, PMB 121, Williamsburg, VA 23188, United States.