Sub-processors
Last updated: 20 July 2026
This page lists the third-party sub-processors Flowgate Systems engages to deliver its service, in line with our Privacy Policy and Data Processing Agreement. Each is bound by a data processing agreement and processes personal data only to provide its part of the service.
| Sub-processor | Purpose | Data processed | Location | Transfer safeguard |
|---|---|---|---|---|
| Supabase | Database, authentication, hosting | Account data, conversation and lead data, booking and deal records | EU (eu-west-1) | UK/EEA hosting; no US transfer for stored data |
| OpenAI | AI processing of DM conversations and call transcripts | Message content, lead qualification context, call transcripts (where notetaker enabled) | United States | UK Addendum to EU SCCs + transfer risk assessment (not DPF-certified) |
| ManyChat | Instagram and WhatsApp messaging integration | Lead usernames/contact names, message content, subscriber data | United States | UK Extension to the EU-US Data Privacy Framework (data bridge) |
| Recall.ai | Meeting recording and transcription (notetaker) | Call audio/video and transcripts (only where notetaker enabled and consent granted) | United States (recording storage region: EU) | EU SCCs + UK Addendum + transfer risk assessment (not DPF-certified) |
| Stripe | Payment processing | Client billing details, Stripe customer ID, subscription status | United States / UK / EU | UK Addendum to the EU SCCs |
| Resend | Transactional and notification email | Client email address, notification content | United States | UK Addendum to the EU SCCs |
| Twilio | WhatsApp notification delivery to coaches (where enabled) | Coach phone/WhatsApp number, notification content | United States | UK Addendum to the EU SCCs |
| Vercel | Hosting and delivery of the dashboard and marketing site | Usage/technical data, request logs | United States | UK Addendum to the EU SCCs |
| DigitalOcean | VPS hosting for the bot cron process | In-transit processing of conversation data during a cron run | United States (region configurable) | UK Addendum to the EU SCCs |
We will update this list before adding or replacing a sub-processor that processes personal data, and will notify clients of material changes by email or dashboard notice so that any objection can be raised.
Questions? Email info@nextdesignwebsite.com.