Sub-processors
Every company that processes data on our behalf, what each one receives, and the safeguard we rely on to send it there. Our privacy policy describes the parts these providers play; this page names them.
Last updated 24 August 2026
Who processes data for us, right now
This is the current list, and the date above is when it was last checked. We keep the names here rather than inside the privacy policy so that changing a supplier does not require rewriting a legal document — which is the edit that never gets made.
OpenAI
Role. The model provider behind the AI advisor
Entity. OpenAI, L.L.C.
Where it processes. United States
What it receives. The messages you type into the advisor and the earlier messages in the same conversation. Not your name, IP address or identity.
Transfer safeguard. Standard Contractual Clauses in OpenAI's data processing addendum
Vercel
Role. Hosting, content delivery and the conversation store
Entity. Vercel Inc.
Where it processes. United States
What it receives. All site traffic, standard server logs including IP address, and the stored copies of advisor conversations.
Transfer safeguard. Standard Contractual Clauses in Vercel's data processing addendum
Vercel Web Analytics
Role. Aggregate traffic measurement
Entity. Vercel Inc.
Where it processes. United States
What it receives. Page views, referrers and country. A short-lived value derived from your request; no cookie, no cross-site identifier, and your IP address is not stored.
Transfer safeguard. Standard Contractual Clauses in Vercel's data processing addendum
Resend
Role. Transactional email
Entity. Resend, Inc.
Where it processes. United States
What it receives. The notification telling us you have been in touch, carrying your name, email and message inside it.
Transfer safeguard. Standard Contractual Clauses in Resend's data processing addendum
Google Workspace
Role. The mailbox an enquiry lands in, and is replied from
Entity. Google Ireland Limited
Where it processes. European Union and United States
What it receives. Your enquiry, once it reaches us, and everything in it.
Transfer safeguard. Google's Data Processing Addendum, incorporating Standard Contractual Clauses and the UK Addendum
Asking for the safeguards
You can ask us for a copy of the safeguards relied on for any provider above and we will send it to you. Use the contact form and say it is a privacy request.
When this page changes, and when the policy does
We will keep this page current. Adding or replacing a provider that does the same job, on terms no weaker, changes this page only, and the date at the top of it moves.
Anything that changes what we collect, why we collect it, who else sees it, or how long we keep it changes the privacy policy itself, and its date moves instead. The distinction is deliberate: it means the date on the policy tells you something has changed that you might actually care about.