Legal
Sub-processors
The companies that help us run collects.io, what each one does, where it processes data and the safeguard in place. Last updated 7 October 2026.
Two weeks free. £1 card check, refunded. Nothing is sent to your customers. Switch off before day 14 and you pay nothing.
This is the Sub-Processor List referred to in paragraph 2.3 of our Data Processing Agreement. We update it before adding or replacing a sub-processor; you then have 10 Business Days to object on data-protection grounds.
Amazon Web Services
- What they do: Hosting, storage, email delivery and machine learning; AI inference through Amazon Bedrock. Bedrock does not use customer inputs to train models.
- Where: UK (London, eu-west-2)
- Safeguard: In region
Supabase
- What they do: Database, sign-in and file storage
- Where: UK
- Safeguard: In region
Nylas
- What they do: Sending email and handling replies
- Where: EU
- Safeguard: In region
Say Digital Ltd (MOHARA)
- What they do: Platform build, operation and maintenance.
- Where: UK. Access to production systems and customer data is restricted to UK-based staff and contractors; team members in other countries work on the code without access to production data.
- Safeguard: In region.
Tonic AI
- What they do: Synthetic data for testing and model development (no customer data sent)
- Where: United States
- Safeguard: EU SCCs and UK IDTA
GitHub
- What they do: Source code and release pipeline (no customer data)
- Where: United States
- Safeguard: Microsoft Products and Services DPA
Vercel
- What they do: Application hosting and compute
- Where: United States (primary), London compute, global edge
- Safeguard: EU SCCs and UK IDTA
Trigger.dev (API Hero Ltd)
- What they do: Background and scheduled jobs
- Where: Frankfurt (jobs); United States (storage)
- Safeguard: EU SCCs / UK IDTA
Sentry (Functional Software)
- What they do: Error monitoring
- Where: Germany
- Safeguard: EU SCCs and UK Addendum
PostHog
- What they do: Product analytics
- Where: EU
- Safeguard: Data Privacy Framework, EU SCCs and UK IDTA
Intercom
- What they do: Support chat, including the Fin assistant, in the platform and on our website
- Where: EU
- Safeguard: In region
Attio Ltd
- What they do: CRM. Receives enquiries submitted through the collects.io website forms and holds sales and partner contact records.
- Data: names, work email, phone, company and message text from website forms. No debtor or invoice data.
- Where: hosted on Google Cloud Platform (Google Cloud EMEA Ltd, Ireland); data centres in Belgium and the United States.
- Safeguard: UK IDTA / Addendum and EU Standard Contractual Clauses for any transfer outside the UK/EEA.
Marker.io
- What they do: In-app feedback and screenshots
- Where: Belgium
- Safeguard: EU SCCs and UK Addendum
Stripe
- What they do: Card payments (billing details only)
- Where: United States
- Safeguard: Stripe data transfer terms; Data Privacy Framework, EU SCCs and UK IDTA
paid.ai (Agent Paid Ltd)
- What they do: Subscription billing and usage metering (billing details only)
- Where: United States
- Safeguard: EU SCCs and UK Addendum
Google Cloud Pub/Sub
- What they do: Gmail push notifications (metadata only)
- Where: United States / EU
- Safeguard: Google terms
Microsoft Azure
- What they do: Microsoft sign-in (OAuth only)
- Where: United States / EU
- Safeguard: Microsoft DPA
Xero
- What they do: Your accounting system (source data)
- Where: Varies by your Xero organisation
- Safeguard: Your own Xero terms
Download our Data Processing Agreement from the footer of any page, or email support@collects.io.