| Provider | What it does | What it receives | Where | Transfer safeguard |
|---|---|---|---|---|
| Supabase, Inc.Privacy policy | Database, authentication and sign-in links | Account emails, company settings, uploaded quote records | Ireland (AWS eu-west-1) | Inside the EEA — none needed |
| Vercel Inc.Privacy policy | Application hosting and delivery | Request metadata, IP addresses in short-lived server logs | Serverless functions pinned to Dublin (dub1); company is US-based | SCCs / EU–US Data Privacy Framework |
| Resend (Plus Five Five, Inc.)Privacy policy | Sending follow-up email and recording delivery events | Recipient name and email address, message content, delivery and bounce events | United States | SCCs / EU–US Data Privacy Framework |
| Stripe Payments Europe, Ltd.Privacy policy | Subscription payments and invoices | Billing name, billing address, VAT ID, payment method — card details never reach us | Ireland | Inside the EEA — none needed |
Current as of the date above.
Deliberately not on this list
No analytics, advertising or session-recording provider is used, because none is present in the product.
Google Fonts is not a recipient. The typefaces are downloaded when the site is built and served from qfutool.com, so no visitor’s browser contacts Google and no IP address reaches it.
No artificial intelligence provider receives your data, and nothing you upload is used to train a model — ours or anyone else’s.