Sub-processors and third-party data vendors
This page names every company that processes personal data on our behalf. We publish it in full, with locations and transfer mechanisms, because a list of vendor categories tells you nothing and every one of our competitors hides behind one.
Last updated: 19 September 2026. Version 1.1.
Our Path Digital Ltd is the data controller for personal data in OurPath. The companies below are our processors (or, where stated, our sub-processors via a processor). They act on our documented instructions, under a written contract containing the terms required by Article 28 UK GDPR, and may not use your data for their own purposes.
How to read this page #
- Family content means data your family creates — messages, expenses, plans, the Info Bank, documents. The vendors that touch it are the ones that matter most, and they are marked ●.
- Transfer mechanism is how a transfer outside the UK is made lawful. "UK Addendum" means the UK Addendum to the EU Standard Contractual Clauses. "DPF (UK Extension)" means the UK Extension to the EU–US Data Privacy Framework.
- Where a vendor is in the UK or the EEA, no restricted-transfer mechanism is needed, and we say so.
1. Core infrastructure #
● Supabase — database, authentication, file storage, backups #
| Entity | Supabase, Inc. |
| What it processes | Everything. Account data, messages, expenses, parenting plans, calendar, Info Bank content, uploaded documents, authentication credentials, backups |
| Where it is stored | United Kingdom — AWS London, eu-west-2 |
| Transfer mechanism | Data at rest does not leave the UK. Limited administrative and support access from outside the UK is covered by the UK Addendum to the EU SCCs |
| Sub-processor | Amazon Web Services (AWS), London region |
| DPA | supabase.com/legal/dpa |
Supabase is where OurPath lives. It runs on AWS infrastructure in London, which is why we can say your family's data is stored in the UK.
● Netlify — website and web portal hosting, and DNS #
| Entity | Netlify, Inc. (United States) |
| What it processes | Requests to ourpath.app and the web portal: IP addresses, device and browser information, and the content of pages served — which, for a signed-in parent, includes family content in transit. Netlify also operates the authoritative DNS for ourpath.app |
| Where | United States, with edge delivery from locations including the EEA and UK |
| Transfer mechanism | UK Addendum to the EU SCCs |
| DPA | netlify.com/legal/dpa |
Cloudflare — bot protection (Turnstile) #
| Entity | Cloudflare, Inc. (United States) |
| What it processes | A short-lived challenge token, your IP address and basic browser signals, on forms such as the waiting list and (in future) account signup, to tell a person from a bot |
| Where | United States, with processing at edge locations including the UK and EEA |
| Transfer mechanism | UK Addendum to the EU SCCs |
| Note | We chose Turnstile over Google reCAPTCHA deliberately: it is cookieless and does not feed an advertising profile. A parent in distress should not be silently added to an ad-tracking graph on the first page they visit |
| DPA | cloudflare.com/cloudflare-customer-dpa |
2. Artificial intelligence #
● Anthropic — tone assist #
| Entity | Anthropic PBC (United States) |
| What it processes | The text of a message you are composing, at the moment tone assist runs. Nothing else — no names, no account data, no message history, no children's data as identifiers |
| Where | United States |
| Transfer mechanism | UK Addendum to the EU SCCs, with a completed transfer risk assessment. Anthropic does not rely on the Data Privacy Framework |
| Training | Your content is not used to train models. This is a contractual term of our commercial agreement |
| Retention at the provider | Not retained beyond the period needed to process the request and meet abuse-monitoring obligations, as set out in our agreement |
| DPA | anthropic.com/legal/commercial-terms — commercial API terms and DPA |
This is the vendor people ask about most, so to be explicit: a draft message goes to Anthropic, a suggestion comes back, neither we nor Anthropic keep the draft, and nobody trains anything on your family.
3. Payments and billing #
There are two billing routes and they use different vendors. Families referred by a professional are billed by us through Stripe. Everyone else subscribes through the App Store or Google Play, where Apple or Google is the seller and we never see the payment details at all.
Stripe — subscriptions billed directly by us #
| Entity | Stripe Payments Europe, Ltd (Ireland) and Stripe, Inc. (United States) |
| What it processes | Card details (which we never see), billing name, email, address and postcode, transaction and subscription records, fraud signals |
| Where | Ireland and the United States |
| Transfer mechanism | Irish entity: EEA, adequacy applies. US entity: DPF (UK Extension), with SCCs plus UK Addendum as a backstop |
| DPA | stripe.com/legal/dpa |
Stripe is a separate controller for some of its own purposes, including fraud prevention and regulatory compliance. Its own privacy policy applies to that processing.
Apple — App Store purchases and in-app subscriptions #
| Entity | Apple Distribution International Ltd (Ireland) |
| What it processes | Where you subscribe through the App Store, Apple takes the payment as merchant of record. We receive a subscription status and an anonymous identifier — not your card details, name or address |
| Where | Ireland |
| Transfer mechanism | EEA — adequacy applies. Apple's own onward transfers are governed by Standard Contractual Clauses |
| Note | Apple is an independent controller for the purchase relationship, under its own terms |
Google — Google Play purchases and in-app subscriptions #
| Entity | Google Commerce Ltd (Ireland) |
| What it processes | As Apple, for Play Store purchases |
| Where | Ireland |
| Transfer mechanism | EEA — adequacy applies. Google LLC is certified under the DPF (UK Extension) for onward US transfers |
| Note | Independent controller for the purchase relationship |
4. Email and notifications #
● Plus Five Five / Resend — transactional and automated email #
| Entity | Plus Five Five, Inc. (trading as Resend) |
| What it processes | Your email address and name, and the content of service emails: new message notifications, swap requests, expense approvals, plan proposals, invitations, password resets, renewal reminders |
| Where | Sending infrastructure is configured to the European Union region (AWS eu-west-1). The company is US-incorporated and its staff can access the platform from the United States |
| Transfer mechanism | UK Addendum to the EU SCCs covering that US access |
| Note | Notification emails tell you that something happened; they do not contain the content of your messages. This is deliberate — email is the least secure surface in the product |
| DPA | resend.com/legal/dpa |
Brevo — marketing email #
| Entity | Brevo SAS (France) |
| What it processes | Your email address, name, marketing preferences, and engagement data (opens, clicks) for marketing emails you have consented to receive |
| Where | European Union |
| Transfer mechanism | EEA — adequacy applies, no additional mechanism required |
| Note | Brevo never receives family content. It holds a marketing contact record and nothing from inside the product |
| DPA | brevo.com/legal/termsofuse |
Marketing email is separate from service email, uses a separate system, and you can unsubscribe from it at any time without affecting the notifications you need. We are not currently running any email marketing campaigns; Brevo is listed because it is the system we would use.
Zoho — our own mailboxes #
| Entity | Zoho Corporation B.V. (EU data centre) |
| What it processes | Anything you send us by email — support questions, data protection requests, complaints, safeguarding reports — and our replies. Our staff mailboxes and the hello@ourpath.app address run on Zoho Mail |
| Where | European Union (Zoho's EU data centre) |
| Transfer mechanism | EEA — adequacy applies |
| Note | We keep our own email and the app's transactional email on deliberately separate systems and separate sending reputations. Zoho never receives anything from inside the product |
| DPA | zoho.com/privacy/dpa.html |
If you write to us about something sensitive, it lands in an ordinary mailbox read by a small number of named people. That is worth knowing before you put something in an email that you would not want in an inbox.
Expo — push notification delivery #
| Entity | 650 Industries, Inc. (trading as Expo), United States |
| What it processes | Push notification tokens and the short notification text |
| Where | United States |
| Transfer mechanism | UK Addendum to the EU SCCs |
| Note | As with email, push notifications say that something happened, not what it said |
Apple Push Notification service (APNs) and Google Firebase Cloud Messaging (FCM) #
| Entities | Apple Inc. / Apple Distribution International Ltd; Google LLC / Google Ireland Ltd |
| What they process | Device push tokens and notification payloads, in transit to your device |
| Where | United States and Ireland |
| Transfer mechanism | Google: DPF (UK Extension). Apple: Standard Contractual Clauses with UK Addendum |
5. Monitoring and analytics #
Google LLC (Firebase Crashlytics) — error and crash monitoring #
| Entity | Google LLC (Firebase Crashlytics) |
| What it processes | Error reports: stack traces, app version, device type, OS, an anonymised user identifier, and the screen where the error occurred |
| What it must never process | Message content, expense descriptions, Info Bank content, children's names, or any family content. We configure scrubbing to enforce this and we test it |
| Where | United States |
| Transfer mechanism | UK Addendum to the EU SCCs |
Google LLC (Google Analytics for Firebase) — product analytics #
| Entity | Google LLC (Google Analytics for Firebase) |
| What it processes | Privacy-first funnel events: which screens were reached, whether onboarding completed, whether a plan was accepted, whether an export was generated. An anonymised identifier, device type and app version |
| What it must never process | Message content, expense descriptions, Info Bank content, or any data about a child. Ever |
| Where | United States |
| Transfer mechanism | UK Addendum to the EU SCCs |
name the actual vendors here. A placeholder on a live sub-processor page is worse than no page, and this is exactly the section a data protection-literate mediator will check.
6. Business operations #
These vendors process data about our customers and contacts, not family content.
| Vendor | Purpose | Location | Mechanism |
|---|---|---|---|
| Zoho Corporation B.V. | Customer support correspondence — see section 4. We do not use a separate helpdesk product | European Union | EEA — adequacy |
| {{ACCOUNTING_VENDOR}} | Invoicing, accounting and statutory records | {{ACCOUNTING_VENDOR_LOCATION}} | {{ACCOUNTING_VENDOR_MECHANISM}} |
| Kids Pass | Membership benefit included with a subscription. Where you activate it, we pass the minimum needed to issue your membership. Kids Pass is a separate controller for its own relationship with you, under its own terms | United Kingdom | UK — no transfer |
7. What we do not do #
- We do not use advertising networks, data brokers, ad-tech SDKs or attribution vendors.
- We do not share family content with any vendor not named on this page.
- We do not allow any vendor to use your data for its own purposes, or to train AI models on it.
- We do not sell personal data to anyone.
8. Changes to this list #
Before we add a new sub-processor that will process family content, we will:
- update this page at least 30 days beforehand, with the vendor, purpose, location and transfer mechanism;
- email account holders who have asked to be notified.
To be notified of changes, email hello@ourpath.app with the subject "Sub-processor notifications".
For vendors that do not touch family content — accounting, helpdesk, marketing infrastructure — we update this page when the change is made.
If you object to a new sub-processor, tell us at hello@ourpath.app. We will explain our reasoning, and if you are not satisfied you may cancel and receive a proportionate refund of the unused part of your term, with your export access unaffected.
9. Questions #
hello@ourpath.app — including if you would like to see a copy of the transfer risk assessment for any transfer listed here.
Version history #
| Version | Date | Change |
|---|---|---|
| 1.1 | 19 September 2026 | First published |
Our Path Digital Ltd · Registered in England and Wales, company number 17406043 · ICO registration ZC250261