Sketchlings
Transparency

Subprocessors

A subprocessor is any third-party service that processes data on our behalf to make Sketchlings work. We keep this list short on purpose, and we publish it openly so parents can see exactly who is involved.

Last updated June 2026.

Lovable Cloud (Supabase)

Provider privacy policy ↗
Purpose
Authentication, primary database, and storage for child profiles and saved creations.
Data processed
Parent email, hashed password, child profile names, age band, drawings, and generated images.
Hosting region
Managed cloud regions with encryption in transit and at rest.

Stripe

Provider privacy policy ↗
Purpose
Payment processing and subscription billing for the Plus plan.
Data processed
Billing name, email, and payment method tokens. Card numbers never touch Sketchlings servers.
Hosting region
Global (Stripe-controlled). PCI-DSS Level 1 certified.

Lovable AI Gateway (Google Gemini)

Provider privacy policy ↗
Purpose
Generates the final image from a child's sketch and structured prompt.
Data processed
The sketch, the structured prompt, and style metadata. No account identifiers are sent to the model.
Hosting region
Routed through Lovable's gateway; provider regions per Google policy.

Resend

Provider privacy policy ↗
Purpose
Transactional email delivery (account, billing receipts, unsubscribe confirmations).
Data processed
Parent email address and message contents of the email being sent.
Hosting region
US/EU regions per Resend's infrastructure.

Changes to this list

We'll update this page whenever we add or remove a subprocessor. Customers on a signed Data Processing Agreement can subscribe to change notifications by emailing privacy@sketchlings.com. You'll receive at least 30 days' notice before any new subprocessor begins processing personal data.

This page is maintained by Sketchlings (Mary Bernert) to answer common security and privacy questions. It is informational and is not a certification or independent audit.