Sub-processors
17 September 2026
These are the third parties that process personal data for us, what each one does, and where the data sits. Every one is engaged under a written contract that limits it to processing on our instructions.
Our application and database run in Amsterdam, Netherlands (EU). Where a processor is established outside the UK and the European Economic Area, the transfer mechanism is named in the table.
Processors
| Service | What it does | Where data is held | Transfer safeguard |
|---|---|---|---|
| Railway — Railway Corp., United States | Application and database hosting | Amsterdam, Netherlands (EU) | UK adequacy regulations for the EEA — no additional mechanism required; UK International Data Transfer Addendum to the EU SCCs with the supplier |
| Cloudflare — Cloudflare, Inc., United States | Content delivery, DNS, client site hosting, cookieless visitor analytics on the demo and client sites, object storage for encrypted backups and site assets, bot protection, inbound support email routing | Global edge network; object storage in the European Union | UK International Data Transfer Addendum to the EU SCCs |
| Stripe — Stripe Payments Europe, Ltd., Ireland | Card payments, subscriptions and invoicing | European Union and United States | UK adequacy regulations for the EEA — no additional mechanism required; UK International Data Transfer Addendum to the EU SCCs for onward US processing |
| Resend — Resend, Inc., United States | Transactional and outreach email delivery | United States | UK International Data Transfer Addendum to the EU SCCs |
| Vonage — Vonage Business Limited, United Kingdom (an Ericsson company) | SMS, voice calls, call forwarding, WhatsApp messaging and number validation | United Kingdom and European Union | UK adequacy regulations for the EEA — no additional mechanism required |
| Deepgram — Deepgram, Inc., United States | Speech-to-text and text-to-speech for the AI Secretary and voicemail transcription | United States | UK International Data Transfer Addendum to the EU SCCs |
| OpenRouter — OpenRouter, Inc., United States | Routes prompts to large language model providers for website copy, call summaries and internal assistance | United States, and the model provider selected for the request | UK International Data Transfer Addendum to the EU SCCs |
| Ideogram — Ideogram AI, Inc., United States | Generates logo concepts for a prospect, and re-works photographs taken from their own website for use on a demo site | United States | UK International Data Transfer Addendum to the EU SCCs |
| Stannp — Stannp.com Limited, United Kingdom | Printing and posting postcards and letters | United Kingdom | No transfer — data stays in the UK |
| PostGrid — PostGrid Inc., Canada | Printing and posting letters | Canada and United States | UK adequacy regulations for Canada (commercial organisations) |
| Porkbun — Porkbun LLC, United States | Domain registration and renewal on behalf of clients | United States | UK International Data Transfer Addendum to the EU SCCs |
| Sentry — Functional Software, Inc., United States | Application error monitoring | European Union (Sentry EU data region) | UK adequacy regulations for the EEA — no additional mechanism required; UK International Data Transfer Addendum to the EU SCCs with the supplier |
| Plausible Analytics — Plausible Insights OÜ, Estonia | Aggregate analytics on our public website, without cookies or cross-site tracking. It is not what measures the response to outreach — that is recorded against a business in our own database, and is described in the privacy policy. | European Union | UK adequacy regulations for the EEA — no additional mechanism required |
| Microsoft Clarity — Microsoft Ireland Operations Limited, Ireland | Heatmaps and session replay on our public website, so we can see where a page confuses people rather than only how many opened it. Run in Clarity’s cookie-less mode: no identifier is stored on the visitor’s device and a session is not joined up across visits. It is never loaded on a signed-in page — no admin console, client portal or form a customer fills in is recorded. | European Union and United States | UK adequacy regulations for the EEA — no additional mechanism required; UK International Data Transfer Addendum to the EU SCCs for onward US processing |
| Google Workspace — Google Ireland Limited, Ireland | Business email and document storage | European Union and United States | UK adequacy regulations for the EEA — no additional mechanism required; UK International Data Transfer Addendum to the EU SCCs for onward US processing |
Where prospect data comes from
These are not processors — they are public sources we read to find businesses that might want a website. Nothing personal is sent to them about you.
| Service | What it does | Where data is held | Transfer safeguard |
|---|---|---|---|
| Companies House — Companies House, United Kingdom | Public register of companies, used to identify newly incorporated businesses to contact | United Kingdom | No transfer — public UK register |
| Google Places — Google Ireland Limited, Ireland | Public business listings, used to find and qualify businesses to contact | European Union and United States | UK adequacy regulations for the EEA — no additional mechanism required; UK International Data Transfer Addendum to the EU SCCs for onward US processing |
Changes to this list
This page is generated from the same configuration the application runs on, so it changes when the system does rather than when someone remembers to update it. Clients on a plan are given notice before a processor handling their data is replaced, as set out in the plan agreement. Questions: privacy@tradesplace.co.uk.