Service providers

Named here because Privacy describes what each category of provider receives, and you should be able to see who those providers actually are. Effective 14 November 2026. Each policy link below was loaded and checked on that date.

Tharu Studio does not run its own servers. The companies below host the service, deliver its email, read receipts when a studio asks, and take subscription payments when that is switched on. Each of them receives personal information in the course of doing so — what a studio and its customers put into Tharu is stored on their systems, not ours.

Hosting, accounts and file storage

Supabase (Supabase privacy policy) holds the database, user accounts and every uploaded file, in the United States, region us-east-1. That is the full contents of a studio’s records: customers, orders, quotes, payments recorded against them, messages and uploaded images. It also runs the function that sends a receipt for reading.

Email delivery

Resend (Resend privacy policy) sends the email Tharu generates — both our own messages to a studio and the messages a studio sends to its customers through Tharu. Resend therefore receives recipient addresses and the full content of those messages.

AI receipt processing

Anthropic (Anthropic privacy policy) receives a supplier receipt image when a studio asks Tharu to read one, together with the small amount of context described in Reading receipts. A receipt is a business document, but it can carry a person’s name, a delivery address or a partial card number, and whatever is on it goes with the image. The suggestion that comes back is never saved to a record until a person at the studio has checked it and chosen to save it.

Payment processing

Stripe (Stripe privacy policy) handles subscription payments from studios to us. Subscription billing is not switched on today, so nothing is being sent to Stripe at present. When it is, Stripe receives the billing contact and the card details, which are given to Stripe directly and never held by us. Stripe does not receive a studio’s customer or order records.

A studio’s own customer payments are a separate matter: Tharu records what a studio tells it was received, and does not collect money from a studio’s customers.

Website analytics

Cloudflare Web Analytics, part of the Cloudflare account above, counts page views on this website. It sets no cookie and does not follow a visitor between sites. It receives the page viewed, the referring site, and general details of the browser and country.

Website and network services

Cloudflare (Cloudflare privacy policy) serves this website, provides DNS for tharu.studio and routes our own addresses. As the network in front of the site it handles visitors’ IP addresses and request details.

Lovable (Lovable privacy policy) hosts the Tharu application at app.tharu.studio, so requests to the application pass through it.

What we do not claim

These companies process data for us under their own terms, which also give them their own reasons to handle it — security, abuse prevention, billing. We therefore do not claim that any of them acts only on our instructions. We make no statement here about how long any of them keeps data, which legal role each takes, or which standards or frameworks each meets. Each company’s own privacy policy is linked above; read it there, because we are not in a position to summarise it for them.

Changes

If we add or replace a provider we will update this page. If the change matters to studios we will say so where it is relevant rather than leaving it to be noticed here.

Questions about anything on this page: [email protected].