Subprocessor Notice

Each subprocessor processes personal data only to provide its service to us and under contractual data-protection obligations. Full card details are held solely by Stripe and are never stored by us.

• Stripe — payment processing and subscription billing.
• Hosting and application-delivery infrastructure that runs the platform.
• Managed PostgreSQL database hosting for application data.
• Analytics and communication providers used, with consent where required, to measure usage and send service messages.

Where a subprocessor processes data outside the UK or EEA, transfers are protected by an approved mechanism such as an adequacy decision, the UK International Data Transfer Addendum or Standard Contractual Clauses. We update this notice when our subprocessors change, and organisations receive any notice required by their service agreement before a new subprocessor handles their information.