Sub-processors
Last updated: July 2026
A “sub-processor” is a third-party company that processes personal data on our behalf to help us run AsbestoPlan. We engage each one under a written Data Processing Agreement (UK GDPR Article 28) and share only the data needed for their service. We do not sell your personal data. This page should be read alongside our Privacy Policy.
Current sub-processors
- Supabase — Database, authentication and file storage. Data: Email, name, hashed password, MFA factors, and the data you create in the app. Region: EU.
- Stripe — Payments and subscription billing. Data: Name, email, billing and subscription details (card data is held by Stripe). Region: US / global (SCCs).
- Resend — Transactional and marketing email delivery. Data: Recipient email, message content and delivery status. Region: US (SCCs).
- Microsoft Clarity — Behavioural analytics (opt-in only). Data: Hashed user id and interaction data — loaded only if you accept analytics cookies. Region: US (SCCs).
- Vercel — Application hosting and content delivery. Data: IP address, request metadata and anything transmitted through the app. Region: US / global (SCCs).
International transfers
Some sub-processors process data outside the UK/EEA. Where they do, we rely on appropriate safeguards — UK adequacy regulations, the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.
Changes
We update this list when we add or remove a sub-processor. Material changes affecting how your data is processed will be reflected here and, where appropriate, notified to you.
Contact
Questions about our sub-processors? Contact adam@cdmmarketing.co.uk.