Subprocessor List

Last updated September 25, 2026

IMARA DIGITAL HOLDINGS LLC uses the service providers listed below to help operate MakeStoryboard for team and business customers. Where a provider processes Customer Personal Data on our behalf, we require appropriate privacy, confidentiality, and security obligations consistent with our Data Processing Agreement (DPA) and applicable law.

This list is limited to providers that may process personal data in connection with delivering, securing, supporting, or maintaining the MakeStoryboard Service. Processing locations may change as vendors update their infrastructure or as MakeStoryboard changes configuration.

Current subprocessors

Provider	Purpose	Data that may be processed	Processing location	Transfer / contractual safeguard
DigitalOcean, LLC	Application hosting, managed database, object storage, backups, and infrastructure services	Account identifiers, Customer Content and uploaded files, application data, request data, logs, and backups	Primary application server: Frankfurt, Germany. Object-storage and other service locations depend on account configuration; support or administrative processing may occur elsewhere.	DigitalOcean DPA; EU-U.S. Data Privacy Framework where applicable, with SCCs / UK Addendum as fallback or where required.
Functional Software, Inc. d/b/a Sentry	Application error monitoring, performance monitoring, diagnostics, and security troubleshooting	Error events, stack traces, device/browser information, IP address or identifiers where included, and limited content fragments if captured in an error context	Sentry offers U.S. and Germany data regions. MakeStoryboard does not represent a specific account data region in this public list; operational support may involve other locations.	Sentry DPA and applicable international-transfer mechanisms, including SCC-based safeguards where required.
AC PM, LLC (Postmark)	Transactional email delivery and delivery diagnostics	Recipient name and email address, message subject/content, message metadata, and delivery events	United States, including U.S.-based infrastructure disclosed by Postmark	Postmark DPA incorporating SCCs and other applicable transfer safeguards.
DataCamp Limited (CDN77)	Content delivery, caching, network performance, and delivery security	IP addresses, request metadata, logs, static/application assets, and content routed through the CDN where configured	Global edge network; DataCamp Limited is established in the United Kingdom	CDN77 / DataCamp DPA and applicable transfer safeguards for processing outside the EEA/UK where required.
Google (Google Workspace; applicable Google contracting entity)	Business email, support communications, documents, and internal service administration	Customer and user contact details, support communications, attachments, and internal records that may contain Customer Personal Data	Global; data location and support access depend on Google Workspace configuration and Google infrastructure	Google Cloud Data Processing Addendum and applicable international-transfer mechanisms.

Other service providers with separate roles

Some third-party providers may act as independent controllers, joint controllers, or receive information directly from a user rather than acting solely as a MakeStoryboard subprocessor. They are not included in the table above solely because they appear in the technology stack.

Stripe. Stripe provides payment processing, subscription billing, fraud-prevention, and related payment services. Stripe processes full payment-card information directly; MakeStoryboard does not store full card numbers. Stripe may act as an independent controller for some processing, including fraud prevention and legal-compliance activities.

Optional sign-in, import, analytics, cookie-consent, and similar services are described in the MakeStoryboard Privacy Policy and Cookie Policy as applicable. A service is not treated as an active MakeStoryboard subprocessor merely because integration code exists; disabled integrations are not listed as current subprocessors.

Subprocessor changes

MakeStoryboard may add or replace subprocessors as the Service evolves. Where required by the DPA, we will use commercially reasonable efforts to provide at least 15 days' advance notice before a new subprocessor begins processing Customer Personal Data, unless an emergency or security need makes advance notice impracticable.

Customers may object to a new subprocessor on reasonable data-protection grounds as described in the DPA. To request the current list or subscribe to subprocessor change notices, email donovan@makestoryboard.com.

Vendor privacy resources

DigitalOcean Data Processing Agreement
Sentry Data Processing Addendum
Postmark Data Processing Addendum
CDN77 Data Processing Agreement
Google Cloud Data Processing Addendum

Contact