FANDEMiQ · Sub-processor register
Every third party that processes fan data on our behalf, what it receives, where it runs, and the transfer mechanism that covers it. Anything marked optional is off until a client switches it on.
| Provider | Purpose | What it receives | Where | Transfer mechanism | When |
|---|---|---|---|---|---|
| Microsoft Azure | Application hosting, media storage, databases | Everything the platform holds | UK South (applications, media); North Europe, Ireland (databases) | None — UK and EU only | Core |
| Amazon Web Services (Rekognition) | Face detection with age range, gender and, where enabled and permitted, mood estimation | Submitted images and video stills; the derived estimates | London (eu-west-2) | None — UK only | Core; switchable per account and per event; off for events in, or uploads from, China, Russia and Vietnam |
| Microsoft Azure AI Vision | Descriptive tags, captions, sponsor logo detection, adult-content screening | Submitted images; the derived tags and scores | West Europe (Netherlands) | UK to EU — adequacy | Core |
| Microsoft Azure Video Indexer | Scene, transcript and audio analysis of video | Submitted video; derived scenes and transcripts | UK South | None — UK only | Core for video |
| Self-hosted background removal | Cutting the fan out of a photo for compositing | Fan photo, processed in memory | UK South, inside our own environment | None — not a third party | Core |
| OpenAI (image editing) | Generative FanMoment compositing (paid tier) | The fan cut-out and the campaign backdrop; no contact details | United States | UK Addendum / EU Standard Contractual Clauses; Data Privacy Framework and UK-US Data Bridge where OpenAI holds certification | Optional — off until a client enables the generative tier on a campaign |
| OpenAI (text) | Smart Films clip descriptions; aggregate analytics assistant | Written descriptions of clips, which can include what fans said on camera; aggregate account data | United States | As above | Optional — each feature off until enabled |
| Resend | Delivery emails carrying a fan’s finished content | Fan email address, message metadata | United States (Resend stores message metadata in the US whichever region sends it) | UK Addendum / EU Standard Contractual Clauses; Data Privacy Framework and UK-US Data Bridge where Resend holds certification | Core — unless the client supplies its own mail server |
| Client-supplied mail server | Delivery emails, where a client prefers its own relay | Fan email address, message metadata | Client-determined | Client-determined | Optional, configured by the client |
| Microsoft Azure Application Insights | Performance and error telemetry | Technical telemetry; no fan content | UK South | None — UK only | Core |
| Slack | Operational alerts to the FANDEMiQ team | System alerts only; no fan content since 2 September 2026 | Slack-managed | None — no personal data of fans | Core (internal operations) |
| Microsoft Commercial Marketplace | Billing and usage metering | Account-level usage counts; no fan data | Microsoft-managed | None — no personal data of fans | Core (billing only) |
Three services touch a browser directly rather than receiving data from us, and are listed for transparency: Google Fonts, loaded by the fan’s browser from Google’s CDN; Google Maps, which plots consented GPS points in a client user’s own browser when they open a heatmap; and Plausible, the cookieless, EU-hosted analytics on this marketing site, which never sees the camera app.
We give clients at least 30 days’ notice before adding or replacing a sub-processor, by email to the registered administrator and by a dated entry below. Clients may object within that window under the data processing agreement.
This register is part of the data protection brief. Questions to hello@fandemiq.net.
Send us your questionnaire and we will answer it against the register and the brief.