1. About this list
To run Honeytale Universe we rely on a small, vetted set of third-party processors ("sub-processors"). Each one handles your data only on our documented instructions and only for the purpose listed below.
We put a Data Processing Agreement (DPA) in place with every sub-processor before it processes your data. Where a processor is hosted outside the EU/EEA, the transfer relies on the European Commission's Standard Contractual Clauses (SCCs) together with supplementary technical measures. Most of our core infrastructure is hosted in the EU.
For your data-protection rights and how to exercise them, see our Privacy Policy.
2. Infrastructure and data storage
These processors host the platform itself and the data that runs it.
Hetzner
Hetzner Online GmbH (Gunzenhausen, Germany) hosts our server. It runs the website, the API and our own sign-in service, and holds the primary Postgres database (accounts, characters, story library, addresses, audit log, background-job state) with the authentication data (password hashes, hashed session tokens, Google account IDs), as well as request logs and IP addresses. Hetzner also keeps daily backups of the whole server for 7 days. Region: EU. Transfer: EU-hosted.
Privacy policyCloudflare
R2 object storage holds generated PDFs and character reference images and, in a separate private bucket, our encrypted database backups (encrypted on our server before upload; Cloudflare does not hold the key). Turnstile protects the sign-up, sign-in and forgot-password forms from bots. Region: storage in the EU (Western Europe); Turnstile and the edge run on the global Cloudflare network. Transfer: US with SCCs.
Privacy policy3. Payments, fulfillment, AI, and operations
These processors deliver specific parts of the Service: taking payment, printing books, generating content, sending email, and keeping the platform healthy.
Stripe
Payment processing (billing name, billing address, payment methods, charge history). Region: US. Transfer: US with SCCs.
Privacy policyLulu Direct
Prints and ships physical books (recipient name, shipping address, phone, the printed PDF). Region: US. Transfer: US with SCCs.
Privacy policyOpenAI
Generates all AI content: story text, illustrations, illustration edits, narration audio (the audiobook voice, read from the story text), and content-safety checks, from the inputs you provide (which can include a child's name, character descriptions, and scene context). Contracting entities: OpenAI Ireland Ltd and OpenAI, L.L.C. (USA). Under OpenAI's API terms, API data is not used to train models by default. Region: US by default; we plan to move to OpenAI's EU data-residency project before public launch. Transfer: US with SCCs.
Privacy policyResend
Delivers transactional email (email confirmation, password reset, email change and security notices, book ready, print shipped). The recipient email address and body, which can contain a child's name, pass through Resend. Region: US. Transfer: US with SCCs.
Privacy policy4. Changes to this list
We may add or replace a sub-processor as the Service evolves. When we do, we will update this page and the "Last updated" date above. For material changes that affect how your data is processed, we may also notify you by email.
Questions about our processors? Email support@fairytale.app.