Company Name (“we”) engages the third parties in the first table below to process personal data on our behalf. Each is subject to a written contract requiring it to process personal data only on our documented instructions and to meet UK GDPR data protection standards.
We notify customers of any change to this list at least 30 days before the new sub-processor begins processing. Customers may object to a new sub-processor in writing within those 30 days; we will work in good faith to resolve the objection or, failing that, we will treat the objection as written notice to terminate the affected service.
Sub-processor list
These parties process personal data today.
| Provider | Service | Jurisdiction | Transfer mechanism | Privacy policy |
|---|---|---|---|---|
| Supabase Inc. | Database, authentication, file storage. Region: London (eu-west-2). Personal data stays in the UK. | United States (parent), United Kingdom (data location) | UK International Data Transfer Addendum to the EU SCCs | Link |
| Vercel Inc. | Application hosting, serverless function runtime, CDN edge. Also the authoritative DNS for odel-labs.com, so it sees DNS queries for both live hosts. Region: London (lhr1). | United States (parent), United Kingdom (compute region) | UK International Data Transfer Addendum to the EU SCCs | Link |
| Cloudflare, Inc. | DNS for hellofixi.com, the legacy domain, which still carries our role mailboxes and so resolves the mail exchangers for them. Sees DNS queries only. It is not the DNS for odel-labs.com, which Vercel serves, and no application traffic is proxied through Cloudflare. | United States (parent) | UK International Data Transfer Addendum to the EU SCCs | Link |
| Stripe Payments Europe, Ltd. | Payment processing, billing subscriptions, tax calculation, invoicing. | Republic of Ireland | Adequacy (EU-UK) | Link |
| Resend | Transactional email delivery (sign-in links, billing notifications, security alerts). Region: EU. | United States (parent), Ireland (region) | UK International Data Transfer Addendum to the EU SCCs | Link |
| Upstash, Inc. | Redis-compatible key-value store for rate limiting and caching. Region: London (eu-west-2). Data stays in the UK. | United States (parent), United Kingdom (data location) | UK International Data Transfer Addendum to the EU SCCs | Link |
| Anthropic, PBC | Large-language-model API (Claude). Used for AI-drafted text on customer instruction; never trained on customer data. | United States | UK International Data Transfer Addendum to the EU SCCs | Link |
| Voyage AI | Text embedding API (voyage-3), transitional. Being retired as Mistral takes over the embedding workload; this entry is scheduled for removal after the cutover stabilises. | United States | UK International Data Transfer Addendum to the EU SCCs | Link |
| OpenRouter, LLC | LLM gateway held as a fallback path for non-critical AI work. Carries traffic only while the fallback flag is enabled. Never trained on customer data. | United States | UK International Data Transfer Addendum to the EU SCCs | Link |
Disclosed, not yet processing
These parties are contracted or scheduled but process no personal data at present. They are listed here because the 30 days’ notice above runs from the day we publish, not from the day processing starts, and because you are entitled to object before it does. Each entry says what it is waiting for. When one begins processing it moves into the list above, and the date it moved is recorded in the change history.
| Provider | Service | Jurisdiction | Transfer mechanism | Privacy policy |
|---|---|---|---|---|
| Functional Software, Inc. (Sentry) | Application error monitoring. Region: Frankfurt (EU). Notice given 6 July 2026; processing begins when the integration goes live. | United States (parent), Germany (region) | UK International Data Transfer Addendum to the EU SCCs | Link |
| Amazon Web Services EMEA SARL (AWS KMS) | Key management service holding the encryption keys that protect customer connection credentials. Region: London (eu-west-2). Handles key material and encryption context only; never receives customer business data. Notice given 6 July 2026; processing begins no earlier than 5 August 2026. | Luxembourg (contracting entity), United Kingdom (data location) | UK International Data Transfer Addendum to the EU SCCs | Link |
| Mistral AI | Text embedding API (mistral-embed) for retrieval-augmented generation. 1024-dim vectors; no training on customer data per contract. Notice given 6 July 2026; processing begins when the embedding cutover goes live. | France (European Union) | Adequacy (EU-UK) | Link |
Notification of changes
To receive email notification of any change to this list, email privacy@yixxoo.comwith the subject line “Sub-processor change notifications”. You can unsubscribe at any time.