> Reviewed against current UK law; under ongoing internal review. Not formal legal advice.
Last updated: 7 June 2026
OptitechAutomation — a UK sole trader (the personal business of Cristian Moise-Putanu), based in Torquay, Devon, United Kingdom — uses the following sub-processors to operate the platform. Each sub-processor is engaged under a Data Processing Agreement or equivalent contractual safeguard.
This list is maintained in accordance with our Data Processing Agreement, which grants Controllers the right to object to new sub-processors within 30 days of notification.
Current Sub-Processors
Supabase Inc.
- Purpose: Database hosting, authentication, and real-time infrastructure.
- Data categories: All personal data stored on the platform (names, emails, phone numbers, booking records, worker profiles).
- Location: EU West (primary); data residency configurable per plan.
- Safeguards: Standard Contractual Clauses (EU-UK); SOC 2 Type II certified.
- Website: supabase.com
Stripe Inc.
- Purpose: Payment processing, subscription management, Stripe Connect for worker payouts.
- Data categories: Payment card tokens, transaction references, billing email addresses.
- Location: United States (PCI-DSS Level 1 certified); EU data residency available.
- Safeguards: Standard Contractual Clauses; PCI-DSS Level 1 compliance.
- Website: stripe.com
Resend Inc.
- Purpose: Transactional email delivery (booking confirmations, reminders, worker notifications).
- Data categories: Email addresses, names, booking reference numbers, email content.
- Location: United States.
- Safeguards: Standard Contractual Clauses.
- Website: resend.com
Vercel Inc.
- Purpose: Application hosting, edge network, and deployment infrastructure.
- Data categories: IP addresses, request logs, technical performance data.
- Location: Global edge network; primary data processing in the United States.
- Safeguards: Standard Contractual Clauses; SOC 2 Type II certified.
- Website: vercel.com
Upstash Inc.
- Purpose: Rate limiting and short-lived session caching.
- Data categories: IP addresses, rate limit counters (no personal content cached).
- Location: EU West.
- Safeguards: Standard Contractual Clauses; data retention set to minutes.
- Website: upstash.com
Sentry (Functional Software Inc.)
- Purpose: Application error monitoring and performance tracing.
- Data categories: Stack traces, error context, anonymised request metadata. No PII in error payloads by configuration.
- Location: United States.
- Safeguards: Standard Contractual Clauses; PII scrubbing enabled.
- Website: sentry.io
Anthropic PBC (Claude API)
- Purpose: AI website generation. When a business owner uses the website generator, the business facts they submit are sent to Anthropic's Claude API to draft website copy for that business.
- Data categories: The business facts the owner enters into the generator — for example trade type/niche, town, service areas, unique selling point, and trading-since year. These are business-description fields rather than third-party customer personal data; owners are asked not to submit other people's personal data into the generator.
- Location: United States.
- Safeguards: Standard Contractual Clauses (or equivalent UK transfer mechanism); Anthropic's commercial API terms state that data submitted via the API is not used to train its models. [SOLICITOR TO CONFIRM: current Anthropic Commercial Terms / DPA reference and transfer mechanism at launch.]
- Website: anthropic.com
Conditionally Engaged (BYO — Business-Provided)
Some Businesses choose to connect their own integrations. In these cases, the Business acts as the Controller for that sub-processor relationship:
- Resend (BYO): Business-provided Resend API key for branded customer emails. The Business is responsible for its own DPA with Resend.
- Twilio (BYO): Business-provided Twilio account for SMS notifications. The Business is responsible for its own DPA with Twilio.
Changes to This List
We will provide 30 days' prior written notice of any addition or replacement of sub-processors by updating this page and notifying affected Businesses. During this period, you may object to the new sub-processor in accordance with Section 6 of the Data Processing Agreement.
Contact
OptitechAutomation — Cristian Moise-Putanu (sole trader)
Torquay, Devon, United Kingdom
privacy@optitechautomation.co.uk