OGP LABS PTE. LTD. ("Variotype") uses trusted third-party providers to help operate, secure, support, analyze, and improve the Service. Depending on the services used, these providers may process personal data, customer content, account information, usage data, or technical metadata on our behalf, or may otherwise receive limited data necessary to provide their services.
The descriptions below provide a general summary of the services each provider may perform and the categories of data they may process in connection with the Service. Actual processing may vary depending on the features used, customer configuration, and changes to our services or the provider's services. The categories listed below are illustrative and not exhaustive.
Customer Data and Core Service Providers
Supabase
Used for authentication, database infrastructure, backend services, and storage. Categories of data: account data, authentication data, application data, stored content, uploaded files, and technical logs.
OpenRouter
Used for AI model routing and access to third-party AI model providers. Categories of data: prompts, conversation content, uploaded file content, images, audio-derived text, user-provided instructions, project context, generated outputs, and related usage metadata.
OpenAI
Used as an AI model provider (GPT models) when requests for its models are routed directly to its API rather than through OpenRouter. Categories of data: prompts, conversation content, uploaded file content, images, audio-derived text, user-provided instructions, project context, generated outputs, and related usage metadata.
Anthropic
Used as an AI model provider (Claude models) when requests for its models are routed directly to its API rather than through OpenRouter. Categories of data: prompts, conversation content, uploaded file content, images, audio-derived text, user-provided instructions, project context, generated outputs, and related usage metadata.
Google (Gemini API)
Used as an AI model provider (Gemini models, including image generation) when requests for its models are routed directly to its API rather than through OpenRouter. Categories of data: prompts, conversation content, uploaded file content, images, audio-derived text, user-provided instructions, project context, generated outputs, and related usage metadata.
xAI
Used as an AI model provider (Grok models) when requests for its models are routed directly to its API rather than through OpenRouter. Categories of data: prompts, conversation content, uploaded file content, images, audio-derived text, user-provided instructions, project context, generated outputs, and related usage metadata.
Stripe
Used for payment processing and subscription billing. Categories of data: billing details, transaction data, subscription records, email address, organization information, and limited account identifiers.
Resend
Used for transactional email delivery. Categories of data: email address, email content, and delivery metadata.
Inngest
Used for durable background job execution, including design generation workflows and the queuing and delivery of transactional email. Categories of data: email address, email template variables, job payloads, design and project identifiers, account identifiers, and execution logs.
divRIOTS (code.to.design)
Used to convert a design into data you can paste into Figma, only when you click Copy for Figma. Categories of data: the design's HTML, CSS and JavaScript, its inlined images, and related request metadata. Processed in the United States by a company based in France.
Brave (Search API)
Used to find design inspiration images when you search for inspiration while starting a project. Categories of data: inspiration search terms and related request metadata. Inspiration thumbnails are loaded from Brave's image servers, which receive your IP address and browser information.
Security, Hosting, and Infrastructure Providers
Cloudflare
Used for content delivery, DNS, and security services. Categories of data: IP address, request metadata, traffic data, and security logs.
Railway
Used for application hosting, deployment, and infrastructure services. Categories of data: technical logs, infrastructure metadata, deployment-related data, and network-level traffic associated with hosted services.
Sentry
Used for error monitoring, diagnostics, and performance tracking. Categories of data: technical logs, crash reports, device and browser information, IP address, limited user identifiers, and error-related metadata.
Analytics and Product Insights Providers
Cookiebot
Used for cookie consent management, consent recordkeeping, and cookie/tracker disclosure on our website. Categories of data: consent choices, consent records, IP address, device and browser information, cookie identifiers, domain and page-path information, and related technical metadata associated with consent collection and website scanning.
Google Analytics
Used for website and product analytics. Categories of data: page visits, usage events, device and browser information, referral data, and IP address.
PostHog
Used for product analytics and feature management. Categories of data: usage events, feature flag data, identifiers, session data, and device and browser metadata.
Development and Internal Operations Providers
GitHub
Used for source code management and development workflows. Categories of data: source code, repository metadata, CI/CD logs, and engineering workflow data.
Additional Information
Certain AI-related providers may route requests to downstream third-party model providers selected through the Service or through routing configurations. Variotype configures OpenRouter to route only to model providers that do not use submitted content or generated outputs to train or improve their AI models. Those providers may still briefly retain content to operate their own services, and retention practices, terms, and regions may vary depending on the provider, model, feature, or configuration used. (openrouter.ai)
If you add your own AI provider API key, we store it encrypted and use it only on your behalf, to send your own requests to the provider you chose (including OpenRouter); we never use it for anyone else, and you can remove it at any time.
Some features let you open a generated design directly in a third-party development environment, such as StackBlitz, Replit, Lovable, Claude, or Codex. When you choose to use one, the generated files are transmitted from your browser to that provider by you; we do not send them on your behalf, and they are not processed by us in that transfer. Your use of those environments is governed by that provider's own terms and privacy policy.
Some providers may act as independent controllers for certain processing activities rather than solely as processors or subprocessors. For example, Stripe states that whether it acts as a controller or processor depends on the context of the processing. (support.stripe.com)
We may update this list from time to time as our providers or services change. Updates will be reflected by revising the effective date on this page. Where required by applicable law or our contractual commitments, we may provide notice of material changes.
For questions about our subprocessors and third-party service providers, contact [email protected].