Last updated: 2 November 2026
Different services, different roles
This page distinguishes suppliers used for product processing from suppliers supporting our website and business administration. A provider may act as a processor, sub-processor or independent controller depending on the activity and its contractual role.
The configured software version and services enabled for your business determine which processing applies. Ask for the agreed provider schedule before using client data.
| Provider | Service and data | Scope |
|---|---|---|
| Cloudflare | Application API, licence and usage services, merchant-category sharing and update distribution. Relevant service identifiers, screened request data, rules and technical connection data. | Product infrastructure; also the website’s network and security layer. |
| OpenAI | External AI categorisation using screened descriptions sent through the application service. Source statement files are not part of this categorisation route. | The configured OpenAI route for the updated service. |
| Anthropic | External categorisation for legacy configurations. Screened descriptions, rather than source statement files. | Relevant only where an older or separately configured service uses this route. |
| Resend | Transactional service emails, including account or reset communications. Recipient addresses and the content necessary for the message. | Where transactional email is enabled. |
| Stripe | Subscription and payment administration, including payer and transaction details. | Where billing is provided through Stripe. This website enquiry form does not take payment. |
| Netlify | Website hosting and enquiry-form processing. Technical request data and the contact information submitted in the form. | Marketing website and enquiries, not client bank-statement processing. |
Locations and safeguards
These providers operate internationally. We do not infer a data-processing location from a provider’s headquarters, or describe the service as UK-only. Your contractual schedule should identify the applicable service, processing locations and UK transfer safeguards.
Ask us for the supplier and transfer arrangements relevant to your deployment, including any relevant adequacy arrangement or contractual safeguard. Provider documentation can inform that review but does not replace the signed customer and supplier agreements.
Changes to suppliers
We update this page when the service arrangement changes. Where we act as a processor, any new or replacement sub-processor must follow the customer agreement’s authorisation, notice and objection process. The provider used for an existing customer is not changed by editing this website.
Provider information
- Cloudflare privacy information
- OpenAI data processing addendum
- Anthropic data processing addendum
- Resend privacy policy
- Stripe privacy policy
- Netlify privacy policy
Contact [email protected] with questions about the provider schedule.