Annex 2 – Sub-processors of IRISORA Studio

1. Lovable – application operation and storage

Company: Lovable Labs Incorporated, 1 Lincoln St, Boston, MA 02111, USA. Data protection contact: dpo@lovable.dev

Services: provision and operation of the application, database, file storage and related server-side functions.

Order data concerned: uploaded eye images, working copies, edited image files, previews, artworks and related project and file metadata.

Processing locations: the database of the IRISORA project is operated in Paris, France. This location statement refers to the database and does not assure that all storage, hosting, support and backup processing takes place exclusively in France.

Contract and transfer arrangements: Lovable's published Data Processing Agreement provides for EU Standard Contractual Clauses for relevant third-country transfers. For a processing chain from processor to sub-processor, it provides for Module 3.

Provider documents: https://lovable.dev/data-processing-agreement · https://lovable.dev/subprocessors · https://lovable.dev/security

2. Google – AI-assisted image editing

Company: Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland. Contact for contractual data protection enquiries: legal-notices@google.com

Services: AI-assisted editing of the uploaded eye images via the paid Gemini API.

Order data concerned: image copies submitted for editing, editing instructions and generated results. Names and contact details of the persons depicted are not transmitted to the AI as separate fields in the regular editing workflow.

Processing locations: international processing in countries where Google or its sub-processors operate facilities. Exclusive processing in Ireland, the USA or the European Union is not assured.

Data use: according to the terms for the paid Gemini API, Google does not use submitted content and generated results to improve its products. Separately, time-limited retention for security and abuse monitoring is provided for.

Contract and transfer arrangements: for the paid Gemini API, the provider terms refer to the “Data Processing Addendum for Products where Google is a Data Processor”, including the supplementary provisions for European data protection law and international data transfers.

Provider documents: https://ai.google.dev/gemini-api/terms · https://business.safety.google/processorterms/ · https://business.safety.google/subprocessors/

3. Google – technical image post-processing

Company: Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland

Services: operation of the rendering service used by IRISORA on Google Cloud Run for technical image post-processing and the calculation of high-resolution output files.

Order data concerned: the image files required for the respective calculation job, editing settings and time-limited access links for retrieving and storing the files.

Processing locations: the calculation service runs in the Google Cloud region configured for the IRISORA project. The registered office in Ireland is not a statement about this technical region or all other processing locations.

Contract and transfer arrangements: the relevant Google Cloud contract terms and the Cloud Data Processing Addendum apply to this service. The data protection terms of the Gemini API do not replace this agreement.

Provider documents: https://cloud.google.com/terms/data-processing-addendum · https://cloud.google.com/terms/google-entity

Further companies within the processing chain

The service providers named above may use further sub-processors. The companies relevant to IRISORA are documented on the basis of the provider documents. The general provider lists do not mean that every company listed there receives all IRISORA images.

IRISORA informs about intended changes to sub-processing in accordance with the procedure agreed in the data processing agreement.