Version: 0.4 · Prepared on: 2026-10-16 · Effective from: 24 October 2026
This register accompanies the Privacy Policy. The following services receive information needed for the functions described. A provider may also have independent legal responsibilities, particularly for payments, identity checks and security.
| Provider or recipient | Function and data | Further information |
|---|
| Stripe / Stripe Connect | Payments, invoices, identity checks and commissions; necessary customer and partner information | Stripe privacy information, including its different roles for payment services and its international transfers |
| Supabase | Accounts, authentication, database and files used by gellatti | Privacy information and data processing addendum |
| Vercel | Hosting and delivery of the website; connection and technical information | Vercel privacy notice |
| OpenAI API | Requested food and label recognition; submitted images and the request information needed to obtain a result | We do not use customer photographs, scans or recipes to train models. Provider technical retention is separate from training. Data processing addendum |
| Resend | Transactional messages; recipient address and the necessary message content | Resend privacy information |
| Sentry | Minimised technical error reports; no session recordings or browsing-performance traces in gellatti | Sentry privacy information |
| Open Food Facts | Product-code lookup through gellatti's server; product code and the server's technical connection information | Open Food Facts privacy information. Product images supplied by external sources may require a separate connection when displayed. |
| Carrier and fulfilment provider | Starter Pack preparation and delivery; delivery name, address and necessary phone number | PINGÜINO GLOBAL S.L. prepares or arranges fulfilment. The carrier used for a shipment is identified in the delivery information. |
| Accountants and competent authorities | Information necessary for accounting, tax and lawful requests | The accounting firm engaged by PINGÜINO GLOBAL S.L., the Spanish Tax Agency and other authorities where required by law |
| Cloudflare | Turnstile protection of forms against automated abuse (when you submit product data or request an e-mail from the demo), using connection, browser and device signals of that check | Cloudflare privacy policy and Turnstile privacy addendum |
| Google, when you choose Google sign-in | Name, email address and account identifier needed for the selected sign-in method | Google privacy information |
Processing and access may take place outside the European Economic Area. Applicable protections can include an adequacy decision or standard contractual clauses with supplementary measures where needed. The relevant entities and safeguards depend on the service and processing activity; a European database location alone does not mean that all provider processing remains in Europe.
For information about recipients, agreements and the safeguards applicable to your data, or a copy of those safeguards: info@gellatti.com.