Subprocessors

Subprocessor register

These are the providers DenBrain Ltd uses to process personal data on behalf of practice customers, and to run the service. This register lists only providers in use; there are no others at the date below. Provider facts were checked against each provider's own published terms on 3 October 2026 and describe the provider's published position. Last updated: 28 October 2026.

New subprocessors, and changes to this list, are notified to practice customers at least 30 days before they are used, as set out in the DPA.

Hostinger

Contracting entity: Hostinger UK Limited is the contracting entity named in Hostinger's terms for customers in the United Kingdom.

Service: Virtual private server hosting for the DenBrain application and database, and outgoing service email (SMTP).

Purpose: Hosting and running the service, and delivering account, password-reset and billing emails.

Data categories: All data held in the service, including patient enquiry data, and the content and recipient of service emails.

Location: Hostinger offers server locations in several countries, including the United Kingdom. DenBrain does not commit to a single data-centre country, and Hostinger's email infrastructure and its own subprocessors may be located outside the United Kingdom.

Transfer mechanism: Hostinger's data processing agreement applies the EU Standard Contractual Clauses and the UK International Data Transfer Addendum to transfers of UK personal data.

Retention and use: Per Hostinger's agreement, Hostinger deletes data after the service ends.

Provider documents: Hostinger data processing agreement (https://www.hostinger.com/legal/dpa); Hostinger terms of service (https://www.hostinger.com/legal/universal-terms-of-service-agreement).

Cloudflare R2

Contracting entity: Cloudflare, Inc..

Service: Private object storage (R2).

Purpose: Private storage of patient photos and generated previews for the periods stated in the retention schedule, and of encrypted database backups in a separate bucket.

Data categories: Patient photos, generated previews, and encrypted database backups.

Location: Cloudflare selects the storage region for an R2 bucket automatically unless a jurisdiction is set. DenBrain does not claim that R2 data is stored only in the United Kingdom.

Transfer mechanism: Cloudflare's customer data processing agreement applies the EU Standard Contractual Clauses with the UK Addendum, and Cloudflare states that it participates in the EU-US Data Privacy Framework and its UK Extension.

Retention and use: Objects are removed by DenBrain on the schedule in the retention schedule; Cloudflare returns or deletes customer content when the agreement ends.

Provider documents: Cloudflare customer DPA (https://www.cloudflare.com/cloudflare-customer-dpa/); Cloudflare R2 data location (https://developers.cloudflare.com/r2/reference/data-location/); Cloudflare subprocessors (https://www.cloudflare.com/gdpr/subprocessors/).

fal.ai

Contracting entity: Features & Labels, Inc. (United States).

Service: Image-generation service used to create the Smile Preview.

Purpose: Creating the illustrative Smile Preview image from the patient's photo, after the patient's explicit consent.

Data categories: The patient's photo and the image-generation instructions, while the preview is created.

Location: fal.ai states that data is held on servers located in the United States and other countries; it does not publish a region list or region choice.

Transfer mechanism: fal.ai's data processing addendum applies the EU Standard Contractual Clauses (Module 2) and the UK International Data Transfer Addendum to the EU Standard Contractual Clauses. DenBrain is not aware of a Data Privacy Framework certification by fal.ai and does not rely on one.

Retention and use: fal.ai documents that request inputs and outputs are by default stored for 30 days; DenBrain sends fal.ai's documented instruction not to store request payloads with every request, and receives the generated image directly rather than as a fal.ai-hosted link. fal.ai's terms also allow it to use anonymised or aggregated usage data to develop its services; DenBrain does not control that.

Provider documents: fal.ai data processing addendum (https://fal.ai/legal/data-processing-addendum); fal.ai privacy policy (https://fal.ai/privacy); fal.ai terms (https://fal.ai/terms).

Stripe

Contracting entity: Stripe Payments Europe, Limited and, where applicable, Stripe Payments UK Ltd, as named in Stripe's services agreement for UK businesses.

Service: Payment processing for DenBrain subscriptions.

Purpose: Taking subscription payments from practice customers (not from patients).

Data categories: Practice customer name, email address, billing details and payment details.

Location: Stripe operates internationally and states that transfers are made under its Data Transfers Addendum.

Transfer mechanism: Stripe's Data Transfers Addendum applies the EU-US Data Privacy Framework (including its UK Extension) where available, and otherwise the EU Standard Contractual Clauses with the UK International Data Transfer Addendum.

Retention and use: Stripe acts as a processor on DenBrain's instructions and as an independent controller for its own fraud-prevention, anti-money-laundering and regulatory purposes; see Stripe's privacy policy.

Provider documents: Stripe data processing agreement (https://stripe.com/legal/dpa); Stripe data transfers addendum (https://stripe.com/legal/dta); Stripe privacy policy (https://stripe.com/gb/privacy); Stripe subprocessors (https://stripe.com/legal/service-providers).

Note on fal.ai and special category data

fal.ai states in its data processing addendum that its services are not designed for special categories of personal data. Smile Preview photos may reveal information about a person's dental condition, so DenBrain treats them with special-category-level protection: they are sent to fal.ai only after the patient's explicit consent, only to create the preview, with fal.ai's request storage switched off, and are deleted from DenBrain's own storage within the periods stated in the retention schedule.