Legal
Sub-processors
Last reviewed: 23 August 2026
Running a website or an app means using other companies to do parts of the job: somewhere to host it, something to send email, something that tells us when it breaks. Some of those companies can see personal data as a result. This is the full list, what each one does, and where it processes data.
When you use this website or contact us
These apply to ownlydigital.co.uk, to enquiries and audit requests you send us, to job applications, and to us getting in touch with a business about our services. For all of this Ownly Digital is the data controller.
Vercel Inc.
- What it does
- Hosts this website and the applications we build, and serves them to visitors
- What it can see
- Anything you submit through a form, plus IP address and request logs
- Where
- London
Cloudflare, Inc.
- What it does
- Blocks automated abuse of our forms and sign-in pages
- What it can see
- IP address and a challenge token
- Where
- Global edge network
Resend (Plus Five Five, Inc.)
- What it does
- Sends our email, including replies to enquiries and notifications
- What it can see
- Name, email address, and the content of the message
- Where
- United States
Functional Software, Inc. (Sentry)
- What it does
- Records technical errors so we can find and fix faults
- What it can see
- Error details and an account identifier. Configured not to send names, email addresses or IP addresses
- Where
- Germany
Anthropic PBC
- What it does
- Reviews the public content of a business website to prepare a written summary before we contact them, and machine translation where a client's app offers other languages
- What it can see
- Text taken from a public web page, or the text being translated
- Where
- United States
Stripe, Inc. / Stripe Payments Europe Ltd
- What it does
- Takes card payments
- What it can see
- Name, email address and billing details. Card numbers go to Stripe directly and are never held by us
- Where
- Ireland and United States
DocuSeal
- What it does
- Sends agreements for electronic signature
- What it can see
- Signer name, email address, signature and the contents of the document
- Where
- European Union
Dialpad, Inc.
- What it does
- Our business telephone system
- What it can see
- Telephone numbers, call times, and call recordings where a call is recorded and announced
- Where
- United States
Calendly LLC
- What it does
- Books calls and appointments
- What it can see
- Name, email address and booking details
- Where
- United States
Companies House
- What it does
- The public register we use to confirm a business exists and who runs it
- What it can see
- Publicly registered company information
- Where
- United Kingdom
Google LLC / Google Ireland Ltd
- What it does
- Public business listings and search, and delivering push notifications to Android apps we build
- What it can see
- Business listing queries, and device tokens for notifications
- Where
- United States and European Union
Slack Technologies (Salesforce)
- What it does
- Internal alerts to our own team
- What it can see
- Operational notifications, which can include a client or enquiry name
- Where
- United States
In the systems we build and run for clients
Where we build and host a website or an app for a client, the client decides what is collected and why, so the client is the data controller and we act on their instructions. Not every provider below is used on every project: each client's contract lists the ones that apply to their service, and they agree to that list.
Vercel Inc.
- What it does
- Hosts this website and the applications we build, and serves them to visitors
- What it can see
- Anything you submit through a form, plus IP address and request logs
- Where
- London
Cloudflare, Inc.
- What it does
- Blocks automated abuse of our forms and sign-in pages
- What it can see
- IP address and a challenge token
- Where
- Global edge network
Resend (Plus Five Five, Inc.)
- What it does
- Sends our email, including replies to enquiries and notifications
- What it can see
- Name, email address, and the content of the message
- Where
- United States
Functional Software, Inc. (Sentry)
- What it does
- Records technical errors so we can find and fix faults
- What it can see
- Error details and an account identifier. Configured not to send names, email addresses or IP addresses
- Where
- Germany
Supabase Inc.
- What it does
- Database, sign-in and file storage for applications with user accounts
- What it can see
- Application data, including account details and anything users upload
- Where
- United Kingdom or European Union
Anthropic PBC
- What it does
- Reviews the public content of a business website to prepare a written summary before we contact them, and machine translation where a client's app offers other languages
- What it can see
- Text taken from a public web page, or the text being translated
- Where
- United States
DeepL SE
- What it does
- Machine translation where a client's app offers other languages
- What it can see
- The text being translated
- Where
- Germany
Stripe, Inc. / Stripe Payments Europe Ltd
- What it does
- Takes card payments
- What it can see
- Name, email address and billing details. Card numbers go to Stripe directly and are never held by us
- Where
- Ireland and United States
Calendly LLC
- What it does
- Books calls and appointments
- What it can see
- Name, email address and booking details
- Where
- United States
Google LLC / Google Ireland Ltd
- What it does
- Public business listings and search, and delivering push notifications to Android apps we build
- What it can see
- Business listing queries, and device tokens for notifications
- Where
- United States and European Union
Apple Inc.
- What it does
- Distributes iOS apps we build and delivers their push notifications
- What it can see
- Device token and crash reports
- Where
- United States
Twilio Inc.
- What it does
- Sends verification codes and text messages
- What it can see
- Mobile number and message content
- Where
- United States
Sanity AS
- What it does
- Stores website content and enquiry submissions for some client sites
- What it can see
- Anything submitted through a form on that site
- Where
- European Union
Loom, Inc. (Atlassian)
- What it does
- Hosts instructional and coaching video
- What it can see
- Video content and viewing activity
- Where
- United States
Data leaving the UK
Where a provider above is in the United States, the transfer is made under the UK Extension to the EU to US Data Privacy Framework, or under the International Data Transfer Agreement where that provider is not certified. Providers shown as being in the United Kingdom, Germany, Ireland or the European Union need no additional transfer mechanism.
Changes to this list
Clients are told in writing at least fourteen days before we add or replace a provider that handles their data, so they have time to object. This page is updated at the same time.
What we do not do
We do not sell personal data, and we do not allow any provider above to use a client's data, or their users' data, to train an artificial intelligence model.
Questions
Email team@ownlydigital.co.uk. Our privacy policy explains what we collect and the rights you have over it.