Service providers and sub-processors

Version 1.8 · effective 14 October 2026

1. Purpose

AgeRail (Lalalu Marketing SL) uses the vendors below to deliver the hosted age-verification service. This page is the list incorporated by reference into the Data Processing Agreement at /dpa. Classification distinguishes Article 28 sub-processors processing Controller Personal Data from controller-side service providers.

AgeRail configures the verification workloads it controls, and the storage of the data they produce, to run within the European Union. Vendor support, security, and telemetry activities incidental to those services are governed by the vendor terms stated below. Delivery of verification results to the Controller's own configured redirect or webhook endpoints is Controller-directed; the location of those endpoints is the Controller's choice and responsibility. Payment and email vendors process their respective data categories under the transfer mechanisms stated for each vendor.

2. Article 28 sub-processors (Controller Personal Data)

Google Cloud

  • Classification: Article 28 sub-processor for infrastructure hosting under the DPA. Google Cloud engages its own sub-processors, identified in its published register linked below.
  • Role: Cloud infrastructure host for AgeRail's verification and core service workloads.
  • Data category: Verification processing data, tenant account and configuration data, operational logs and, when enabled, operator-only calibration records, with no face template or face hash retained.
  • Region: European Union, for AgeRail verification and core service workloads
  • Transfer mechanism: AgeRail configures the workloads it controls, and the storage of the data they produce, to run within the European Union under the Google Cloud Data Processing Addendum; vendor support, security, and telemetry activities incidental to those services are governed by that Addendum and the service-specific terms it references; delivery of verification results to the Controller's own configured redirect or webhook endpoints is Controller-directed (location is the Controller's choice and responsibility)
  • Vendor DPA:cloud.google.com/terms/data-processing-addendum
  • Downstream sub-processors:cloud.google.com/terms/subprocessors

EU AI inference providers

  • Classification: Article 28 sub-processors.
  • Role: AI model inference for the verification service.
  • Data: the data a single request needs; the provider keeps none of it beyond the request, save for a limited period where security requires.
  • Region: European Union.

3. Controller-side service providers

The following vendors process payment data and transactional email data as controller-side service providers of AgeRail for AgeRail's own commercial and operational purposes. They are not Article 28 sub-processors for Controller Personal Data under the DPA.

Stripe

  • Classification: Controller-side service provider (not Art. 28 sub-processor for Controller Personal Data)
  • Role: Payment processing for prepaid credit purchases and related billing events
  • Data category: Payment and billing data (customer and payment-method references, amounts, tax identifiers where provided)
  • Region: Global processing including the United States, as operated by Stripe
  • Transfer mechanism: Stripe Data Processing Agreement; EU-US Data Privacy Framework and Standard Contractual Clauses where applicable
  • Vendor DPA:stripe.com/legal/dpa

Postmark

  • Classification: Controller-side service provider (not Art. 28 sub-processor for Controller Personal Data)
  • Role: Transactional email delivery (service and account messages) and email to business contacts
  • Data category: Email content and delivery metadata (recipient address, subject, delivery events)
  • Region: Processed by Postmark under its service infrastructure (including US processing where applicable)
  • Transfer mechanism: Postmark Data Processing Agreement; EU-US Data Privacy Framework and Standard Contractual Clauses where applicable
  • Vendor DPA:postmarkapp.com/dpa

Resend

  • Classification: Controller-side service provider (not Art. 28 sub-processor for Controller Personal Data)
  • Role: Transactional email delivery (service and account messages); takes a message Postmark could not send, or is tried first when so configured
  • Data category: Email content and delivery metadata (recipient address, subject, delivery events)
  • Region: Mail is sent from the European Union (Ireland); Resend stores message content, delivery logs, and account records in the United States
  • Transfer mechanism: Resend Data Processing Addendum; EU-US Data Privacy Framework and Standard Contractual Clauses
  • Vendor DPA:resend.com/legal/dpa

4. Changes

Changes that add or replace an Article 28 sub-processor processing personal data under the DPA are governed by section 8 of the DPA.

5. Contact

Questions about this list: privacy@agerail.com.