---
title: "Subprocessors | Once Books"
description: "The third parties that process data for Once Books, what each one receives, and the 30 days’ notice we give before we add or replace any of them."
source: "https://www.oncebooks.com/subprocessors"
---

Legal

# Subprocessors

Effective 18 August 2026

These are the third parties that process data on our behalf to run Once Books. We give **30 days’ notice** before adding or replacing one. This list reflects what is actually enabled today; the sensitive tiers below are named as they’re engaged, before any real photo is processed.

## Active today

| Provider | Purpose | Data received | Location |
| --- | --- | --- | --- |
| BuildBase | Accounts, workspaces, billing and credits | Email, name, workspace membership, and subscription/payment metadata. Never photos or book images. | United States |
| Stripe (via BuildBase) | Payment processing | Billing details and card data, handled on Stripe’s systems. We never see card numbers. | United States / EU |
| Cloudflare | Website and application hosting, content delivery, and bot protection | Requests to the site and app. The marketing site is static and carries no personal data. App and content-delivery traffic passes through Cloudflare, including generated book images. Its Turnstile widget guards the guest draft in the studio and sees the signals it needs to tell a person from a bot. | Global edge |
| Google (Analytics) | Consent-gated usage analytics, on the marketing site and the studio | Page views and a random visitor ID on the site; on the studio, checkout events only (book tier, price, order ID). No child data, photos, prompts or book content. Loads only if you agree. | United States |
| Meta Platforms (Pixel) | Consent-gated advertising measurement, on the marketing site and the studio | A visit event on the site; on the studio, purchase events only (book tier, price, order ID). No child data, photos, prompts or book content, and no ads are targeted at children. Loads only if you agree. | United States |
| Microsoft (Clarity) | Consent-gated session analytics on the marketing site | A masked recording of site pages (text and inputs are masked) and a random visitor ID. No child data, photos, prompts or book content. Loads only if you agree. | United States |
| Crisp IM | Live chat on the marketing site | The messages you send us and a session cookie. Your name and email only if you provide them. No child data, photos or book content. | European Union |

A boundary worth stating: our accounts and billing provider **never receives a photograph or a generated image**. The platform has no file API at all. That’s architectural, not a policy we hope holds.

## Being onboarded

Not yet enabled. Each provider is named here once it is under a signed agreement, for the tiers that touch a child’s likeness, one that prohibits training on your content.

**AI image & text generation**

These receive a child’s reference images and story text to generate pages. Each will be listed here by name once it is under a signed agreement that prohibits training on your content, and our system refuses, in code, to send identity references to any provider that trains on user data.

**Safety moderation**

Scanning uploads and generated images for harmful content, including child-safety hash-matching. We are selecting vendors with an explicit child-protection mandate; each will be named here once engaged.

**Error monitoring & diagnostics**

Crash and error reporting to help us fix faults, off today and never carrying your photos or book content. Named here by vendor if and when it is enabled.

Questions, or to be notified of changes: [privacy@oncebooks.com](mailto:privacy@oncebooks.com). How data is handled overall is in the [Privacy Policy](https://www.oncebooks.com/privacy), and the cookies the analytics providers above set are listed on the [cookie policy](https://www.oncebooks.com/cookies) page.