Sub-processors
Providers that process personal data on our behalf for operators’ sites, where they process it, and the safeguards for transfers out of the country.
In use
| Provider | Service | Where | Transfer safeguards |
|---|---|---|---|
Provider Google Cloud | Service Hosting of the database, services and storage, in the region the administrator chose | Where United States, Australia, and Belgium | Transfer safeguards Standard contractual clauses; EU–US Data Privacy Framework To be confirmed |
Provider Postmark | Service Service email, and email from sites that have not connected a mail provider | Where United States | Transfer safeguards Standard contractual clauses; EU–US Data Privacy Framework |
Providers an operator connects, such as a payment provider or email account, are that operator’s processors and are not listed here. Details marked “To be confirmed” are the provider’s published position.
Being added
| Provider | Service | Where | Transfer safeguards | In use from | Objections until |
|---|---|---|---|---|---|
Provider WhatsApp Business Platform (Meta) | Service Sign-in codes sent by WhatsApp | Where United States To be confirmed | Transfer safeguards Standard contractual clauses; EU–US Data Privacy Framework To be confirmed | In use from Dec 1, 2026 | Objections until Dec 1, 2026 |
Provider Amazon Web Services (Amazon SES) | Service Service email, and email from sites that have not connected a mail provider, sent within each data region | Where United States, Australia, and Germany To be confirmed | Transfer safeguards Standard contractual clauses; EU–US Data Privacy Framework To be confirmed | In use from Dec 3, 2026 | Objections until Dec 3, 2026 |
Provider Amazon Web Services (AWS End User Messaging) | Service Sign-in codes sent by text, and notice texts from sites that have not connected a text carrier, sent within each data region | Where United States, Australia, and Germany To be confirmed | Transfer safeguards Standard contractual clauses; EU–US Data Privacy Framework To be confirmed | In use from Dec 3, 2026 | Objections until Dec 3, 2026 |
Operators are told of a new provider thirty days before it processes their data, and can object until the date shown.
For our business
| Provider | Service | Where | Transfer safeguards |
|---|---|---|---|
Provider Stripe | Service Card payments for plans, credits and texts | Where United States To be confirmed | Transfer safeguards Standard contractual clauses; EU–US Data Privacy Framework To be confirmed |
Provider VIES (European Commission) | Service Checking a customer’s EU VAT number with its country’s register | Where Belgium To be confirmed | Transfer safeguards None |
Provider Australian Business Register | Service Checking a customer’s Australian business number and GST registration | Where Australia | Transfer safeguards None |
Provider Google reCAPTCHA | Service Checking that a request to become an operator comes from a person | Where United States To be confirmed | Transfer safeguards Standard contractual clauses; EU–US Data Privacy Framework To be confirmed |
Providers that process personal data of our customers and of people asking to join, for billing, tax number checks, sign-in codes and checking that a request comes from a person.