LEGAL DRAFTVersion 1.1 • September 2026

Subprocessor Registry

Poron engages vetted third-party service providers (“Subprocessors”) to perform specific infrastructure and data processing functions. Below is our declared registry.

Google Cloud Platform (Gemini API)

Location: United States (GCP Data Centers)

Purpose: Multimodal AI try-on inference and image synthesis

Data Handled: Garment & wearer input imagery, prompt configuration

Paid enterprise tier — customer inputs are NOT used to train public Google AI models.

Supabase Inc.

Location: United States

Purpose: Managed PostgreSQL 16 database, Auth session verification, encrypted asset object storage

Data Handled: User credentials, workspace metadata, private asset versions, consent records, credit ledger

AES-256 encryption at rest, strict tenant Row Level Security (RLS) enforcement.

Stripe Inc.

Location: United States

Purpose: Subscription billing, credit top-up pack checkout, webhook processing

Data Handled: Payment method tokens, customer IDs, subscription status, invoice metadata

PCI-DSS Level 1 certified. No raw credit card numbers are ever processed or stored by Poron.

Notice of Subprocessor Updates

We maintain rigorous technical and legal evaluations before onboarding any new subprocessor. Workspace owners will be notified at least thirty (30) days in advance of any additions or replacements to this registry via email or in-app announcement.