Sub-processors
These providers process data on our behalf. Where a provider processes data outside the European Economic Area, we rely on the EU-US Data Privacy Framework where it is certified, and otherwise on the European Commission's standard contractual clauses in its data processing terms. We give 14 days' notice before adding or replacing a sub-processor, as described in the DPA.
| Provider | Purpose | Data | Location | Link |
|---|---|---|---|---|
| Oracle Cloud Infrastructure | Application, database and worker hosting | Account data, customer content, integration data and service records | Frankfurt, Germany (EU) | Provider information |
| Cloudflare | CDN, secure tunnel and Turnstile bot checks | Network requests and bot-check signals | Global network; Cloudflare, Inc. is in the United States | Provider information |
| Cloudflare R2 | Object storage for files and backups | Attachments, generated images and encrypted backups | United States (Eastern North America) | Provider information |
| Cloudflare Workers AI | Image generation | Image prompts and generated images | Global network; Cloudflare, Inc. is in the United States | Provider information |
| OpenRouter | AI model routing and embeddings | Prompts, relevant connected data and generated responses; data collection denied and zero data retention requested | United States; routed model providers may process in the United States and other countries | Provider information |
| Groq | Voice transcription | Voice audio and transcripts | United States | Provider information |
| Resend | Transactional and channel email delivery | Recipient address, message content and delivery status | United States | Provider information |
| SerpAPI | Search results and trend research | Site domain, keywords and search queries | United States | Provider information |
Services you connect
These services are used only when you or your organisation connect them, sign in with them or pay through them. Each acts under its own terms and privacy policy.
| Provider | Purpose | Data | Location | Link |
|---|---|---|---|---|
| Search Console and Analytics reporting; optional sign-in | Authorised property data and account profile information | Google's processing locations | Provider information | |
| Meta | Optional Facebook sign-in | Account profile information | Meta's processing locations | Provider information |
| Apple | Optional Apple sign-in | Account profile information | Apple's processing locations | Provider information |
| Telegram | Agent messaging and approvals you set up | Messages, channel identifiers and agent responses | Telegram's processing locations | Provider information |
| Discord | Agent messaging and approvals you set up | Messages, channel identifiers and agent responses | Discord's processing locations | Provider information |
| GitHub | Connected site content and approved publishing | Repository content and approved changes | GitHub's processing locations | Provider information |
| Approved publishing to connected organisation pages | Organisation page identifiers, post content and connection data | LinkedIn's processing locations | Provider information | |
| Your WordPress host | Connected site content and approved publishing | Site content and approved changes | Your host's location | Provider information |
| Shopify | Shopify app billing and connected store services | Merchant, shop, subscription and requested store data | Shopify's processing locations | Provider information |
| Stripe | Web subscription payments | Customer, subscription, invoice and payment status data | Stripe Payments Europe, Ireland; may transfer to the United States | Provider information |