Legal
Subprocessors
Last updated: 24 August 2026
This page lists the providers Cravd Studio's platform (the guest app, restaurant portal, kitchen display, and backend) depends on to run, based on a direct technical review of how the product actually works — not a generic vendor list. We don't sell data to any of them.
Product subprocessors
Providers that process personal data on Cravd's behalf to run the guest app, restaurant portal, kitchen display and backend.
Supabase
Receives: menu content, order records, staff account data
OpenRouter / Cerebras
Receives: only the note text. OpenRouter routes this specific call to Cerebras as the model-inference provider, so Cerebras — not only OpenRouter — receives it. No name, table number, or other order detail is sent.
Render
Receives: everything the backend processes, as the infrastructure it runs on
Resend
Receives: staff email addresses, and the details submitted through the website's demo request form. Guests are never emailed — we don't have a guest email address to send to.
Cloudflare
Receives: guest and staff web traffic, in transit. Cloudflare is Render's own subprocessor, not one we contract with directly.
Website service providers & other recipients
Providers used only for the marketing website and the demo enquiry form. Google Analytics is listed here as a processor: our Google Analytics account has "Google products & services" data sharing turned off, so Google processes Analytics data on our instructions rather than as an independent controller.
Microsoft 365
Receives: the demo enquiry details submitted through the website's form, once Resend has relayed them to our inbox.
Google Analytics
Receives: analytics and usage information about how visitors use cravdstudio.com, only after Analytics consent. Google may use the visitor's IP address at collection to derive approximate location before discarding it for UK/EU traffic — we don't perform any further anonymisation ourselves.
International transfers
EEA transfers: Render, Resend and Microsoft 365 each rely on the EU Standard Contractual Clauses under their own standard terms; Resend is also certified under the EU-U.S. Data Privacy Framework, as is Google Analytics when you've given analytics consent. UK transfers: Render and Resend rely on the UK Addendum to those Clauses; Microsoft's Online Services Terms extend the same Clauses to UK transfers; Resend and Google Analytics (again, consent-gated) are also certified under the UK Extension to the Data Privacy Framework. Resend's domain region setting (currently Ireland) controls only where mail is dispatched from — Resend's own account data is stored in the United States regardless, which is why its transfer safeguards apply. Cloudflare is Render's own subprocessor, covered by Render's contractual obligation to apply equivalent protections rather than a separate arrangement of ours. Supabase and OpenRouter/Cerebras process product data, not visitor or demo-enquiry data from this website. Contact info@cravdstudio.com for a copy of any of these safeguards.
More information
See our Website Privacy Notice for the fuller picture of what we collect and why, and our AI & Automated Translation Notice for the translation flow specifically.
This list is kept up to date as the platform changes.
← Back to Legal & Trust