International data transfers
Where your information goes when you use our software from outside the United States, what protects it on the way, and the one thing we are careful never to claim: we are not certified under the EU-US Data Privacy Framework.
The short version
A plain-words summary for orientation. The sections below are the full statement.
- We are a small business in California. Our database, our website and the companies that help us run them are all in the United States, so using our software means your data comes here.
- We are not currently certified under the EU-US Data Privacy Framework, and you will not find a claim on this site that we are. Certification is a real filing with the US Department of Commerce, and we have not made it.
- What actually protects a transfer out of Europe today is the contract terms our providers publish, which use the European Commission's Standard Contractual Clauses, plus your own decision to use software you know is run from the United States.
- Nine companies process data for us. Section 5 names each one and says what it holds.
- We cannot keep your data inside Europe today. If that is a requirement for you, this is the page that tells you so before you sign up rather than after.
- If we certify under the Framework later, this page will say so, with the date we did it.
1. Who this is about
CabDesign and StackDesign are operated by Bespoke Woodcraft Studio LLC, a California limited liability company, at 688 N Rimsdale Ave, Covina, CA 91722, United States.
Both products are browser software for designing cabinets, rooms and tool storage. They are free to use during our open beta. We have no office, no subsidiary and no staff in the European Union, the United Kingdom or Switzerland, and we have not established a company anywhere in Europe.
This page covers both products and both websites, cabdesign.app and stackdesign.app. It sits alongside our Privacy Policy, which is the longer document and governs where the two overlap.
2. Where your data actually is
In the United States. All of it.
Your account, your projects, your dimensions, your materials and any customer records you type in live in our database, which our provider Supabase hosts in its us-west-2 region in Oregon, in the United States. We confirmed that region on the project record on August 21, 2026.
The website itself is served by Vercel, a United States company. Payments, when there are any to take, run through Stripe, a United States company. Email we send you goes out through Resend, a United States company. Our product analytics, which only runs if you accept cookies, sends to PostHog's United States cloud. The AI Designer sends what you type to an AI provider in the United States to generate the reply.
So there is no version of this service where your work stays inside Europe. If you use our software from the European Economic Area, the United Kingdom or Switzerland, you are sending your information to the United States, and it is processed there.
3. The EU-US Data Privacy Framework: what we are not
We are not in it. Nobody should read this page and think we are.
We are also not currently certified under its UK Extension or under the Swiss-US Data Privacy Framework. We do not appear on the participant list the US Department of Commerce publishes, and we make no claim, on this page or anywhere else on our sites, of adherence to the Framework's principles as a certified participant.
The Framework is not a badge a company can decide to wear. A US company joins it by self-certifying to the US Department of Commerce, publishing a policy that commits it to the Framework's principles, paying an annual fee, submitting to Federal Trade Commission enforcement, and naming an independent dispute-resolution body. Companies in it appear on a public list. We have done none of that, so we are not on that list.
We are saying this plainly because the alternative is worse. A page that implies participation without the filing behind it is a misrepresentation the FTC can act on, and it would tell you your data has protections it does not have. We would rather you know exactly what you are getting.
4. What carries these transfers instead
Our providers' own contracts, and your informed choice to use a United States service.
The contracts our providers publish
Every company that processes data for us does so under that company's own data processing agreement. Those agreements are where the European transfer safeguards actually live: the providers we use publish data processing agreements that rely on the European Commission's Standard Contractual Clauses for transfers out of the European Economic Area, and in most cases on the United Kingdom's international transfer addendum alongside them. Those are approved transfer mechanisms under the GDPR, and they are what our chain of processors relies on.
We are naming a mechanism our providers publish, not one we invented. Each provider's current agreement is on its own website, and the terms it offers can change without us. When we learn that a provider has changed its transfer terms in a way that matters, we will update this page.
Your own decision
The other half is simpler. You are choosing to use software you can see is run by a small business in California, with a California address on this page and prices in US dollars. Nothing about that is hidden from you at signup, and this page exists so it is not hidden after signup either.
A lawyer would call the second half a transfer necessary to perform the contract you asked us to perform, under Article 49(1)(b) of the GDPR. That is our understanding of it rather than a determination anyone has made for us, and it is not a substitute for the safeguards described above. It is also a narrow route, which is one reason certification is on our list to revisit.
What we cannot offer today
We cannot host your data in Europe, we cannot offer an EU-only processing option, and we have not signed Standard Contractual Clauses directly with individual customers. If your organization requires any of those, our software is not a fit for you yet, and we would rather tell you here than let you find out during a procurement review.
5. Who processes data for us
Nine companies, each doing one job. Nothing here is an advertising network or a data broker.
This list is the same one in section 6 of the Privacy Policy. Every entry was checked against the code that actually runs, not against a vendor list someone typed once.
| Provider | What it does for us | Where it processes |
|---|---|---|
| Supabase | Our database and sign-in. Holds your account, your projects, your materials and any customer records you enter. | United States, region us-west-2 in Oregon |
| Vercel | Hosts the websites and the small server functions behind them. | United States |
| Stripe | Payments and subscriptions, when there is something to pay. Card details go to Stripe and never reach our servers. | United States, with Stripe's own global processing |
| Resend | Sends the email we send you: sign-in links, welcome mail, support replies, billing notices. | United States |
| Anthropic | Generates the AI Designer's replies from what you type and the project context needed to answer. | United States |
| An alternative AI model, reachable only by our own platform administrators for internal testing. It would receive the same messages and project context Anthropic receives, and no customer conversation is routed to it. This is a separate matter from Sign in with Google. | United States | |
| Upstash | A short-lived counter kept against your IP address, one per endpoint you call, so one caller cannot flood an endpoint and take the service down for everyone else. It holds no name, no email, no account id and nothing you typed. | United States |
| PostHog | Product analytics, and only after you accept cookies. Tells us which pages get used, not who you are. | United States, the us.i.posthog.com cloud |
| Ahrefs | Counts page visits. Sets no cookie and cannot identify you. | Outside the United States in part, under the provider's own terms |
If we add a provider that handles personal information, we will name it in the Privacy Policy before any customer data reaches it, and add it here.
6. The AI Designer, specifically
The AI Designer is the part of the product where the most sensitive thing you own, your own design work, leaves our systems for someone else's. So it gets its own paragraph.
What you type, plus the project context needed to answer it, is sent from our server to an AI provider's API, which generates the reply. Your browser never talks to the AI provider directly. Anthropic is the provider in use and the one section 4 of the Privacy Policy describes: under the commercial API terms we use, your content is not used to train models, and the provider's operational logs age out on a short rolling window.
Our server also carries a route to Google's Gemini API that only one of our own platform administrator accounts can switch on, and we use it for our own testing, so no customer conversation is sent to Google. A third option labelled ChatGPT appears in the same internal switch and is not connected to anything. Whichever route runs, the processing happens in the United States.
Please do not paste anything into the assistant that you would not want processed by a third-party AI provider, including other people's personal information you have no right to share.
7. What we never do with data that crosses a border
- We do not sell personal information, and we never sell your customers' details.
- We do not share data with advertising networks or data brokers, and there are no advertising pixels on our sites.
- We do not use your designs, dimensions or customer records to train an AI model, ours or anyone else's.
- We do not move data to a new provider in a new country without saying so in the Privacy Policy first.
8. Your rights, and how to complain
If you are in the European Economic Area, the United Kingdom or Switzerland, the GDPR can apply to you even though we are in the United States, because it follows the person rather than the company. You have the rights to access, correction, erasure, restriction, portability and objection, and the right to withdraw consent where we rely on it. Section 11 of the Privacy Policy explains how to use each one, and you can delete your account yourself from your account settings.
You also have the right to complain to your own supervisory authority: your national data protection authority in the EEA, the Information Commissioner's Office in the United Kingdom, or the Federal Data Protection and Information Commissioner in Switzerland. You do not need to come to us first, though we would like the chance to fix it.
We have not designated a representative in the European Union or the United Kingdom under Article 27 of the GDPR. Our reading of our own position is that we do not offer or direct our services to people in Europe today: our prices are in US dollars only, our sites are in English only, our address and phone number are in California, and we do no marketing in Europe. If that changes, designating a representative is part of what changes with it, and we will say so here.
9. If we certify later
Certification is a live question for us rather than a closed one. The founder's decision as of August 21, 2026 is to revisit EU-US Data Privacy Framework self-certification after the open beta, once we know whether we have European users worth building for.
If we certify later, this page will say so, with the date of the certification, the scope it covers, the independent dispute-resolution body we name, and a link to our entry on the Department of Commerce list so you can check it yourself. Until you read that here, assume the answer is the one at the top of this page.
10. Changes to this statement
We will update this page when our providers change, when where they process changes, or when our own certification position changes. The date at the top always shows the current version. A change that matters to you, such as adding a processor that handles personal information, gets posted here before it takes effect.
11. How to reach us
Email is the fastest way, and a person reads it.
- CabDesign: support@cabdesign.app
- StackDesign: support@stackdesign.app
- By post: Bespoke Woodcraft Studio LLC, 688 N Rimsdale Ave, Covina, CA 91722, United States