Sub-processors
{COMPANY_LEGAL_NAME} uses the third-party sub-processors listed below to provide {PRODUCT_NAME}. This list is indicative at this stage of the product's development and may change before or after launch as we finalise vendor selection.
| Sub-processor | Purpose | Data processed | Region(s) |
|---|---|---|---|
| Stripe | Billing and payment processing | Payment card details, billing contact info | {US / UK / EU — confirm per Stripe account config} |
| Resend | Transactional and campaign email delivery | Customer email addresses, message content | {US — confirm region} |
| Twilio | SMS delivery | Customer phone numbers, message content | {US / UK — confirm region} |
| Convex | Application database and backend hosting | All application data, including garage customer data | {confirm region} |
| Vercel | Application hosting and content delivery | All application data in transit; hosting infrastructure only | {confirm region} |
| Anthropic | AI-assisted classification of MOT advisory text, triage of inbound customer replies, and drafting of suggested replies for staff to review | Vehicle facts, MOT advisory text, the body of an inbound message, and a customer's first name only. Never a customer's phone number or email address — these are removed before anything is sent (see note below). | {US — confirm region} |
Note on AI processing
Where AI assistance is used, the model provider operates under a commercial agreement with a no-training term: content submitted through the API is not used to train models. AI output is always a *suggestion* — a category or a draft message — that a member of garage staff reviews before it is acted on. No message is sent to a customer, and no price is calculated, on the basis of a model's output alone. Opt-out ("STOP") handling is performed entirely by deterministic code and never by a model.
Personal data is minimised before submission: phone numbers and email addresses are stripped and replaced with placeholders, and only a first name is included where a draft message needs one.
Changes to this list
We may add, remove, or replace sub-processors as the Service evolves. Where a change is material, we will give customers at least {14} days' notice (by email or in-app notice) before the new sub-processor begins processing personal data, in line with the notice period set out in our Data Processing Agreement. Customers may object to a new sub-processor on reasonable data protection grounds within that notice period, as set out in the DPA.
This page reflects the sub-processors in use as of the date below; it is not a permanent or exhaustive commitment to any single named vendor.
Last updated: {DATE}