Outsource by The Good Picture

Legal

Sub-processors

The third-party providers The Good Picture uses to deliver Outsource, what each one processes, and where.

Version 2.0Last updated 1 August 2026Effective 1 August 2026

Note

This list is the single source of truth, shared with our Privacy Policy and Security page. Your primary data is stored in the EU (Frankfurt).

On this page
  1. 1.Overview
  2. 2.Current sub-processors
  3. 3.Data residency & transfers
  4. 4.Changes & notifications

1.Overview

Outsource is operated by The Good Picture, based in Nairobi, Kenya. To deliver the Service we rely on the third-party providers below, who process personal data on our behalf as sub-processors. We remain responsible for the data we entrust to them and engage each under a data-processing agreement with appropriate safeguards, including Standard Contractual Clauses for transfers outside the European Economic Area where applicable.

2.Current sub-processors

Sub-processorPurposeData processedLocation
SupabasePrimary database, authentication & file storageAccount data, submitted content & files, encrypted integration tokensEuropean Union — Frankfurt (eu-central-1)
VercelApplication hosting, CDN & cookieless web analyticsRequest/log metadata, IP address (transient), aggregate usageUnited States / global edge network
AnthropicAI content generation (Claude)Content you send to AI features. Not used to train models.United States
PostmarkTransactional email deliveryRecipient name & email, notification contentUnited States
n8n CloudWorkflow automation & orchestrationContent & metadata passing through automated workflowsEuropean Union
SentryError monitoring & diagnosticsDiagnostic & log data, limited technical user identifiersUnited States
PaystackPayment processing (subscriptions & invoices)Billing contact & payment metadata. Card data handled by Paystack (PCI-DSS Level 1); we never see full card numbers.Nigeria / South Africa
LinkedInSocial publishing — only when you connect itProfile identifier, OAuth tokens, content you choose to publishUnited States / European Union
MetaSocial publishing — only when you connect itProfile/page identifier, OAuth tokens, content you choose to publishUnited States / European Union

3.Data residency & transfers

Your primary data (account, content, files) is stored in the European Union. Providers whose processing stays within the EEA include Supabase, n8n Cloud. For providers outside the EEA, transfers are covered by Standard Contractual Clauses and, where relevant, supplementary measures such as encryption. See our Privacy Policy for the full transfers section.

4.Changes & notifications

We update this page whenever we add or replace a sub-processor. Business customers with an active data-processing agreement can request advance notice of changes by writing to contact@thegoodpicture.com, and may object to a new sub-processor on reasonable data-protection grounds.