Draft for legal review. 35 details that only the company can supply are not filled in yet. They are shown [like this]. This page is not in force until they are and a lawyer has reviewed it.
Sub-processors
Last updated 6 October 2026
These companies process personal information for 3D Thing, under written contracts that limit them to what we ask and require them to protect it. When our customers use 3D Thing to receive feedback from their own clients, these are also the sub-processors under our data processing addendum.
| Company | What it does for us | Information | Where | Transfer safeguard |
|---|---|---|---|---|
| Vercel Inc. | Hosting and delivery of the website and the editor, and running the website's server code | Everything a browser sends to our website and editor, including IP addresses | Global delivery network; the website's server code runs in Singapore | Vercel data processing addendum with EU Standard Contractual Clauses and the UK addendum; EU-US Data Privacy Framework |
| Render Services, Inc. | The server that runs our API | Account, project, feedback and billing-status records as they pass through the API; server logs | Singapore | Render data processing addendum with EU Standard Contractual Clauses |
| Supabase, Inc. | The database that holds accounts, projects, feedback and published link settings | Account, project, feedback and billing-status records | Singapore, on Amazon Web Services | Supabase data processing addendum with EU Standard Contractual Clauses |
| Cloudflare, Inc. | Object storage (R2) for models, images and published files | Stored project files | Storage in the Asia-Pacific region, delivered through Cloudflare's global network | Cloudflare data processing addendum with EU Standard Contractual Clauses and the UK addendum; EU-US Data Privacy Framework |
| GoDaddy Inc. | Registering our domain name and answering the lookups that send visitors to our servers | The lookups for our domain names. No account, project or model information | United States, on a global name server network | GoDaddy data processing addendum with EU Standard Contractual Clauses |
| Google LLC and Google Ireland Limited (Google Analytics) | Counting visits to our public web pages with Google Analytics, only for visitors who agree | Two cookie ids, the pages opened, the site that sent the visitor, browser and device type, and an approximate location worked out from the IP address, which Google does not keep. Nothing from an account, a project or the editor | United States and other Google data centres | Google Ads Data Processing Terms with EU Standard Contractual Clauses; EU-US Data Privacy Framework |
| Resend (Plus Five Five, Inc.) | Sending email: sign-in links, the welcome message, the reply to a demo request, feedback and decision notifications, account closure and legal notices | Recipient email address, the text of the email, and whether it was delivered, bounced or marked as spam | Japan (the Tokyo region our sending domain is set to). Resend is a United States company | Resend data processing addendum with EU Standard Contractual Clauses |
| Razorpay Software Private Limited | Taking payments in India | Name, email, billing details and payment details you give Razorpay; we never see card numbers | India | Razorpay acts under Reserve Bank of India rules and its own terms as a payment provider |
| Stripe, Inc. and Stripe Payments Europe, Ltd. | Taking payments outside India, when switched on | Name, email, billing details and payment details you give Stripe; we never see card numbers | United States and Ireland | Stripe data processing agreement with EU Standard Contractual Clauses; EU-US Data Privacy Framework |
Services you choose to connect
These are not our sub-processors. They receive information only because you, or the owner of a model you are viewing, chose to use them, and they handle it under their own terms:
- Google (Sign in with Google): only if you choose to sign in with Google.
- Google (Google Analytics): only if you agree to analytics on our public pages.
- YouTube (youtube-nocookie.com): only when a model owner has placed a YouTube video in the scene.
- Addresses the model owner typed in: a logo, image, video or lighting file the owner linked from their own site loads from that site.
- Webhook addresses and single sign-on providers that a customer sets up for their own account or team.
Changes
We update this page at least 30 days before a new sub-processor starts handling personal information. Customers with a data processing addendum can object in that time by writing to [Privacy email address for access, deletion and other data requests]; if we cannot resolve the objection, they can end the affected service and we refund any prepaid time they cannot use.