Sub-processors
Last updated: [DATE]
Birdly uses external suppliers to operate the Service.
Where a supplier processes Customer Personal Data on Birdly's behalf as part of Birdly's processor role, it may be a sub-processor. Other suppliers may act as independent controllers for some processing, for example certain payments or advertising activities.
Current UK providers — VERIFY BEFORE PUBLICATION
| Provider | Purpose | Primary processing/location information | Transfer basis / notes |
|---|---|---|---|
| Supabase | Database and backend | Primary Birdly database region: Paris, France (EEA) | UK→EEA adequacy where UK GDPR applies; verify provider DPA/onward access |
| Vercel | Website/application hosting and edge delivery | Multi-region/global depending on feature | Verify contracting entity and transfer safeguards |
| SureSMS / [UK SMS PROVIDER] | Text messages | [VERIFY] | Verify DPA/location |
| Resend | Transactional/system email | EU/US depending on service | Verify DPF/SCC/UK Addendum or other safeguard |
| Frisbii / [UK SUBSCRIPTION PROVIDER] | Subscription/payment management | Denmark/EEA / [VERIFY] | Verify UK production flow |
| Clearhaus / [UK ACQUIRER] | Card acquiring | Denmark/EEA / [VERIFY] | May act as independent controller for parts of payment processing |
| [AI PROVIDER IF USED] | AI extraction/summarisation of Customer Personal Data | [VERIFY] | Include only if Customer Personal Data is actually sent |
| [SUPPORT PROVIDER] | Customer support | [VERIFY] | Include if applicable |
Do not include MobilePay unless the UK product actually uses it.
Meta belongs in Privacy/Cookies for advertising measurement; do not automatically label Meta a sub-processor unless the contractual role supports it.
Changes
Where the DPA applies, the Customer gives Birdly general authorisation to use sub-processors subject to the DPA. Birdly gives reasonable advance notice of a material new/replacement sub-processor where required, and the DPA explains the objection process.