Sub-processors

A sub-processor is a company we use to provide AgoraScan that may process personal data, including data we process for business customers under our Data Processing Addendum. We check each one's security and privacy commitments, and each has agreed in writing to protect the data and use it only to provide its service to us.

We'll give business customers at least [30 days'] notice of a new sub-processor by updating this page and emailing those who [subscribe to updates / have accepted our Data Processing Addendum]. You can object on reasonable data protection grounds, as set out in the Addendum.

• Vercel Inc. (USA). Hosting, serverless functions that run scans and the AI review, report file storage (Vercel Blob, London), scheduled jobs and cookieless visitor statistics. Data: all service data in transit, report files and screenshots, server logs including IP addresses. Location: file storage in London (lhr1); functions in [London (lhr1): set before launch, otherwise Washington DC (iad1)]; logs and support may be accessed from the USA. Safeguard: EU-US Data Privacy Framework and UK Extension [confirm certification], or Standard Contractual Clauses with the UK Addendum in Vercel's DPA.
• Neon (Databricks, Inc.) (USA). Database (PostgreSQL) holding accounts, scans, credits, leads and findings progress. Location: London (AWS eu-west-2). Safeguard: data stored in the UK; Standard Contractual Clauses with the UK Addendum for any support access from outside the UK.
• Anthropic PBC (USA). AI models (Claude) that write the expert-style review. Data: screenshots and text of scanned pages, which may include personal data shown on those pages. Location: USA. Retention: [as agreed with Anthropic: confirm]. Not used for model training. Safeguard: Standard Contractual Clauses with the UK Addendum in Anthropic's DPA [and DPF certification if applicable].
• Vercel AI Gateway (Vercel Inc., USA). Routes AI requests to Anthropic when we use it instead of calling Anthropic directly. Data: as for Anthropic. Safeguard: as for Vercel.
• Google LLC / Google Ireland Ltd (Google Analytics). Only for visitors who accept analytics cookies: measures how people find and use the site. Data: pages viewed, referring site, device and browser details and a cookie ID; private report links and email addresses are removed first, and advertising features are off. Location: EU and USA. Safeguard: EU-US Data Privacy Framework and UK Extension, and Google's data processing terms.

• Clerk, Inc. (USA). Sign-in, accounts and sessions. Data: name, email, Google account id if used, sign-in records (IP address, device, browser). Location: USA. Safeguard: [DPF certification or Standard Contractual Clauses with the UK Addendum in Clerk's DPA].
• Stripe Payments UK Ltd / Stripe Payments Europe Ltd / Stripe, Inc. Payments, subscriptions, invoices and tax calculation. Data: name, email, billing country and address, VAT number, payment details (held by Stripe only), purchase history. Location: UK, EU and USA. Safeguard: EU-US Data Privacy Framework and UK Extension, Standard Contractual Clauses. Stripe also acts as an independent controller for fraud prevention and its legal obligations.
• Resend (Plus Five Five, Inc.) (USA). Sending service emails: report ready, receipts, Watch alerts, renewal reminders and leads to agencies. Data: email address, name, email content including report links and lead details. Location: [USA (us-east-1) or EU (eu-west-1): confirm region]. Safeguard: [DPF certification or Standard Contractual Clauses with the UK Addendum].

• Google LLC (USA): Chrome UX Report API. Receives the web address being scanned to fetch real-visitor speed data. No personal data about our users. [Only if CRUX_API_KEY is enabled.]
• Cloudflare, Inc. (USA): family-safe DNS lookup (1.1.1.3) used to check whether a website is on adult or malware lists. Receives the host name being scanned only.

If you choose "Sign in with Google", Google processes your sign-in under its own privacy policy. If you click a partner link in a report, the partner processes your data under its own policy.

AgoraScan is run by Grid Design Agency Limited's own staff in the United Kingdom, who provide support and expert reviews. They are not sub-processors.