Version 3, 4 October 2026
Last updated: 4 October 2026
OptiTech Automation is the trading name of Cristian Moise-Putanu, a sole trader based in Torquay, Devon, England.
This page is the authorised list of sub-processors for the purposes of UK GDPR Article 28(2), Clause 7.4 of the Business Owner Terms and Conditions, and Schedule 1 of those Terms. It is versioned and dated. Versions 1 and 2 are available on request from privacy@optitechautomation.co.uk.
Every entry below was verified against the code on 15 September 2026, provider by provider. Where a provider is engaged only when a feature or a key is in place, the entry says so rather than leaving you to assume it is running. Where a provider is one you supply yourself, the entry says that too.
Each sub-processor is engaged under a data processing agreement or an equivalent contractual safeguard, receives only the data it needs, and is required to protect it. We do not sell personal data and we do not use it for advertising.
How this list changes
We give at least 30 calendar days' written notice before engaging a new sub-processor or replacing one on this list. We do it by updating this page and telling affected Business Owners. You may object in writing inside those 30 days on legitimate data protection grounds, and where an objection cannot be resolved you may end the affected part of the Service without penalty, with a pro rated refund of anything prepaid for that part. That right is in Clause 7.5 and Schedule 1 of the Business Owner Terms, not only on this page.
Earlier versions of this page are available on request.
Current sub-processors
Supabase Inc.
- Purpose: Database, authentication, and file storage.
- Data categories: Every category the platform stores: names, email addresses, phone numbers, addresses, booking records, worker profiles, job photographs.
- Location: European Union, Republic of Ireland (Dublin), AWS eu-west-1.
- Safeguards: UK to EEA transfer under the UK adequacy regulations for the EEA (UK GDPR Art. 45 / DPA 2018 s.17A); SOC 2 Type II certified. Where Supabase support staff outside the EEA access data to resolve a support request, that access is covered by the UK Addendum to the EU Standard Contractual Clauses in Supabase's Data Processing Addendum, with a transfer risk assessment on file.
- Website: supabase.com
Vercel Inc.
- Purpose: Application hosting, edge network, deployment, and provisioning of a Business Owner's custom domain.
- Data categories: IP addresses, request logs, technical performance data. For a custom domain, the domain name.
- Location: Global edge network; primary data processing in the United States.
- Safeguards: Enrolled in the EU-US Data Privacy Framework and its UK Extension, DPF register ID 6847; UK Addendum to the EU Standard Contractual Clauses as fallback; SOC 2 Type II certified.
- Website: vercel.com
Stripe Inc. and Stripe Payments UK Ltd
- Purpose: Payment processing, subscription management, and Stripe Connect payouts to Business Owners.
- Data categories: Payment card tokens, transaction references, billing email addresses.
- Location: United States and United Kingdom. Stripe Payments UK Ltd is the UK contracting entity.
- Safeguards: Stripe, Inc. is enrolled in the EU-US Data Privacy Framework and its UK Extension, DPF register ID 10014, for US processing; UK Addendum to the EU Standard Contractual Clauses as fallback; PCI-DSS Level 1.
- Website: stripe.com
Resend Inc.
- Purpose: Transactional email delivery: booking confirmations, reminders, worker notifications.
- Data categories: Email addresses, names, booking reference numbers, email content.
- Location: United States.
- Safeguards: Enrolled in the EU-US Data Privacy Framework and its UK Extension, DPF register ID 8907; UK Addendum to the EU Standard Contractual Clauses as fallback.
- Note: A Business Owner may connect its own Resend account for branded customer email. Where it does, that Business Owner is the controller of that relationship and is responsible for its own agreement with Resend.
- Website: resend.com
Upstash Inc.
- Purpose: Rate limiting, sign-in lockout, and short-lived storage of one-time codes.
- Data categories: IP addresses and request counters. No personal content is cached.
- Location: European Union or United States, depending on configuration.
- Safeguards: EU processing relies on the UK adequacy regulations for the EEA (UK GDPR Art. 45). Any US transfer is made under the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Retention is measured in minutes.
- Website: upstash.com
Mapbox Inc.
- Purpose: Routing and arrival estimates, and worker GPS position while a job is active.
- Data categories: Worker coordinates and job coordinates.
- Location: United States.
- Safeguards: UK Extension to the EU-US Data Privacy Framework. No personal data is retained by Mapbox beyond the routing session.
- Engaged when: a routing key is configured. Without one the platform falls back to a straight line distance calculation and nothing is sent to Mapbox.
- Website: mapbox.com
postcodes.io
- Purpose: Turning a UK postcode into coordinates and area data, for routing and job matching.
- Data categories: A postcode. No name and no contact detail is sent.
- Location: United Kingdom. No overseas transfer.
- Website: postcodes.io
Companies House (UK Government)
- Purpose: Look-up of publicly registered company and officer information, to check business details given to us.
- Data categories: A company name or a registration number.
- Location: United Kingdom. No overseas transfer.
- Website: find-and-update.company-information.service.gov.uk
Apple, Google and Mozilla push services
- Purpose: Delivering the push notifications a user has chosen to receive.
- Data categories: The device push token and the notification payload.
- Location: United States and each vendor's global infrastructure.
- Safeguards: Data Privacy Framework certification where available, otherwise the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
- Engaged when: the user opts in to push notifications.
- Website: apple.com, google.com, mozilla.org
Functional Software Inc. (Sentry)
- Purpose: Error and performance monitoring, so faults are found and fixed.
- Data categories: Stack traces, error context, request metadata that may incidentally include an identifier present when a fault occurred.
- Location: United States and European Union.
- Safeguards: Enrolled in the EU-US Data Privacy Framework and its UK Extension, DPF register ID 5869; UK Addendum to the EU Standard Contractual Clauses as fallback; EU processing relies on the UK adequacy regulations for the EEA. Personal data scrubbing is enabled.
- Engaged when: a monitoring key is configured. Without one the monitoring code does nothing and nothing is sent.
- Website: sentry.io
Sightengine SAS
- Purpose: Automated moderation of uploaded job and proof photographs.
- Data categories: The uploaded image.
- Location: European Union, France.
- Safeguards: UK to EEA transfer under the UK adequacy regulations for the EEA.
- Engaged when: the photo moderation feature and its keys are in place. Without them no image is sent.
- Website: sightengine.com
Anthropic PBC (Claude API)
- Purpose: (1) AI website generation. When a Business Owner uses the website generator, the business facts they submit are sent to Anthropic's API to draft website copy for that business. (2) Fallback summarising and reply drafting for our own sales correspondence, used when Groq is unavailable. A person approves anything before it is sent.
- Data categories: For (1), the business description fields the owner enters, for example trade type, town, service areas, unique selling point and trading-since year. Owners are asked not to submit other people's personal data into the generator. For (2), the same sales-correspondence data described under Groq.
- Location: United States.
- Safeguards: Anthropic is not enrolled in the EU-US Data Privacy Framework. Transfers are made under the Standard Contractual Clauses and the ICO's UK Addendum contained in Anthropic's Data Processing Addendum, with a transfer risk assessment on file. Anthropic's commercial API terms state that data submitted through the API is not used to train its models.
- Website: anthropic.com
Groq, Inc. (Groq Cloud API)
- Purpose: Primary AI drafting and triage for our own sales correspondence, and the website assistant. When a business replies to an email we have sent, the reply is passed to Groq's API so it can be summarised and a suggested response drafted for a person to review. Nothing Groq produces is sent to anyone without a person approving it first.
- Data categories: The business contact details held in our own sales pipeline (business name, contact name, work email address, website, trade and area), the content of email correspondence a business sends us, and the text a visitor types into the website assistant.
- Applies to: our own prospective-customer correspondence and our own website. This sub-processor is not part of the platform service delivered to a Business, and no Business's own customer, worker or booking data is sent to Groq.
- Location: United States.
- Safeguards: Groq is not enrolled in the EU-US Data Privacy Framework. Transfers are made under the Standard Contractual Clauses and the ICO's UK Addendum contained in Groq's Data Processing Agreement, with a transfer risk assessment on file. Groq's terms state that data submitted through the API is not used to train its models.
- Website: groq.com
Telegram Messenger Inc.
- Purpose: Delivering short private operational alerts to the operator, for example that a new lead, booking or support message needs attention.
- Data categories: Minimised to what is needed to act, typically a name and an email address.
- Location: United States.
- Safeguards: We minimise the personal data included in an alert and, where a transfer occurs, rely on appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Where a suitable safeguard cannot be confirmed for a given alert type, we further reduce or omit the personal data sent. We keep this channel under review and will move to a mainstream operational channel where that better protects the data.
- Website: telegram.org
Cal.com, Inc.
- Purpose: Scheduling demo and discovery calls for our own sales.
- Data categories: A prospect's name, email address, and any notes given when booking a call.
- Applies to: our own prospective-customer correspondence, not to any Business Owner's data.
- Location: United States.
- Safeguards: UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses, or Data Privacy Framework certification where held.
- Website: cal.com
Xero
- Purpose: Our own bookkeeping only: subscription invoices and payments are written into OptiTech Automation's own Xero account. No Business Owner data is processed by Xero, and no accounting integration is offered to Business Owners (council 2026-09-22 and 2026-09-24, P-0011: the integration that was described here until 24 September 2026 is not offered; should one ever be offered it will be re-listed here under Terms 7.5 with 30 days' notice).
- Data categories: Our own subscriber billing records.
- Location: United Kingdom contracting entity. The Xero group is headquartered in New Zealand with group companies including Australia.
- Safeguards: Contracted through Xero's UK entity under its data processing agreement. Any intra-group transfer is covered by that agreement and appropriate safeguards.
- Engaged when: Always, for our own bookkeeping.
- Website: xero.com
Business-provided, where the Business Owner is the controller
Some Businesses connect their own accounts. In these cases the Business acts as controller for that relationship and is responsible for its own agreement with the provider.
- Twilio (business-provided). SMS notifications such as arrival alerts and job reminders are sent through the Business Owner's own Twilio account. This is how SMS is sold: the pricing page describes it, word for word, as "SMS (via your own Twilio connection) & in-app notifications". A platform-level fallback exists in the code for messages that have no business behind them, and it is not offered as part of the subscription.
- Resend (business-provided). A Business Owner may supply its own Resend API key for branded customer email, instead of the platform's.
- Xero (business-provided). The optional accounting integration described above connects to the Business Owner's own Xero account.
Not currently engaged
Kept here rather than deleted, so that the history of this list is readable.
- Intuition Machines, Inc. (hCaptcha). Bot and abuse protection on public forms. Shown as removed from the current list on 15 September 2026, because the platform setting that engages it is off, verified against the live database on that date, and while it is off no visitor data reaches hCaptcha. If it is turned on we will give the notice this page promises before it is engaged again, and it will move back into the list above. When engaged it receives the visitor's IP address, browser and device characteristics and interaction signals, in the United States, under the EU-US Data Privacy Framework and its UK Extension, DPF register ID 6388, with the UK Addendum to the EU Standard Contractual Clauses as fallback. It is served on the basis of our legitimate interest in keeping public forms free of automated abuse (UK GDPR Article 6(1)(f)), and it sets no advertising or tracking cookie.
Changes
Version 3, 4 October 2026. GitHub and Cloudflare R2 were listed in version 2 for a weekly off-site backup job that has not yet run successfully; they are removed until it does, and will be listed again with notice before any data reaches them. This page describes who processes data for us and nothing more: it makes no backup, restore or recovery commitment.
Version 2, 15 September 2026. This version was rebuilt from a verification of the code, provider by provider, rather than edited. Eight providers that the code calls were missing from version 1 and are now listed: Mapbox, Xero, Telegram, Cal.com, postcodes.io, Companies House, the Apple, Google and Mozilla push services, and Sightengine. Sentry, Mapbox and Sightengine now say what engages them, because each is gated on a key and listing it as running when it is not is as misleading as omitting it. hCaptcha moves to "not currently engaged", dated, because the setting that engages it is off. The Cloudflare R2 entry says plainly that the weekly encrypted copy is not offered as a restore commitment. Twilio stays business-provided, and the entry quotes the pricing page so that the two cannot drift apart. The section on how this list changes now states the objection window and the right to leave the affected part of the Service, which Clause 7.5 and Schedule 1 of the Terms give. Retell AI is named nowhere on this list: a column of that name exists in the database, nothing reads or writes it, and no code in either repository calls that provider.
Version 1, 8 September 2026. Available on request from privacy@optitechautomation.co.uk.
Data Privacy Framework register entries on this page were verified against the official register on 2 September 2026. The next scheduled verification is 1 March 2027. Nothing on this page claims a verification that has not happened.
Contact
OptiTech Automation is the trading name of Cristian Moise-Putanu, a sole trader based in Torquay, Devon, England.
privacy@optitechautomation.co.uk