Sub-processors

Article 1 - Why this overview exists

To deliver our service we engage other parties: a database provider, a hosting provider, a payment service, an email service. Those parties process data on our behalf. Under the General Data Protection Regulation they are called sub-processors, and Article 28 requires that you, as a client, know who they are.

We publish that list openly instead of sending it on request. That way you can judge for yourself, before signing an agreement, whether you want to work with these parties, and you do not have to ask for it.

Article 2 - Changes

We announce a new sub-processor at least thirty days before it starts processing data, by email to the contact address of your account and by updating this overview. If you object in writing within that period and we cannot resolve it together, you may terminate the agreement as of the date the change takes effect, without notice period and without cost. That is a deliberate choice: a duty to notify is worth nothing to someone who cannot object.

Article 3 - Overview of sub-processors

Supabase — database, file storage and user accounts. Processes: account details, company details, content, messages and figures. Location: European Union (Frankfurt). Basis: a processor agreement with standard clauses.

Vercel — hosting of the website and the client portal. Processes: technical request data such as IP address and browser details, and temporarily the content of your page requests. Location: European Union, with a worldwide network for delivering static files. Basis: a processor agreement with standard clauses.

Stripe — payments, subscriptions and invoices. Processes: name, email address, billing details and payment details. Payment details never pass through our own systems: they go straight from your browser to Stripe. Location: United States and Ireland. Basis: standard contractual clauses and the EU-US Data Privacy Framework.

Resend — sending email. Processes: email address, name and the content of the messages we send you. Location: United States. Basis: standard contractual clauses.

Anthropic — the language model behind our internal content support and growth advice. Processes: the company details and brand profile needed for that particular advice. Data from several clients never goes into the same request, and the data is not used to train models. Location: United States. Basis: standard contractual clauses.

Ayrshare — automated publishing to social channels. Processes: the content that is published and the connection details of your channels. Location: United States. Basis: standard contractual clauses. This party is only engaged if you choose automated publishing; with manual publishing nothing goes to Ayrshare.

Meta Platforms — Facebook and Instagram, for publishing, retrieving comments and messages, and advertising figures. Processes: the content and the data of your own channels. Location: United States and Ireland. Basis: standard contractual clauses and the EU-US Data Privacy Framework. Only applies to the channels you connect yourself.

Google — advertising figures from Google Ads and, if you give permission for it, website statistics through Google Analytics. Location: United States and European Union. Basis: standard contractual clauses and the EU-US Data Privacy Framework.

Cloudflare — security and the delivery of images and video. Processes: technical request data. Location: a worldwide network with processing in the European Union where possible. Basis: standard contractual clauses.

Article 4 - Our production team outside the European Union

Part of our content production is carried out by our own team outside the European Union. That is not a sub-processor within the meaning of Article 28 but staff working under our responsibility; we mention it here anyway, because the effect for you is the same: your data is viewed outside the European Union.

For that transfer we have concluded standard contractual clauses and carried out an assessment of the level of protection. Access is limited to the data needed to make content: brand profile, visual material and planning. Billing details, payment details and the data of your own leads are not accessible to that team; that is enforced in the database itself and not only in the interface.

Article 5 - Questions

Do you have questions about this overview, would you like to see the processor agreement with one of these parties, or do you want to object to a new sub-processor? Please get in touch through the contact address at the bottom of this page. We reply within five working days.