Transparency
Who processes your data
Every company that touches personal data on our behalf, what they do, and where. We update this page before adding anyone new.
| Who | What they do | Where | Safeguards |
|---|---|---|---|
| Vercel Inc. | Hosting and delivery of the website and app | USA, with EU/UK edge regions | UK IDTA / EU SCCs in Vercel’s DPA; data at rest in the EU region |
| Neon Inc. | The database — your account, answers and plans | EU (Frankfurt) | Processed and stored in the EU; encrypted at rest and in transit |
| Anthropic PBC | The coach: writes plans, reviews and replies from the text you provide | USA / EU | UK IDTA and EU SCCs; zero data retention for API traffic; your text is never used to train models |
| Resend Inc. | Sending email (verification, invites, reminders, digests) | EU region | EU SCCs; only your name, email and the message content |
| Stripe Payments Europe Ltd. | Payments and subscriptions | Ireland / USA | Stripe is a separate controller for payment data; we never see or store card numbers |
| Google Ireland Ltd. (Analytics 4) | Anonymous usage of the public site only, and only with your consent | EU / USA | Consent-gated, IP anonymised, never loaded inside the signed-in app |
What none of them get
No sub-processor receives your data for their own purposes. Nobody sells or shares it with advertisers or data brokers, and nobody uses it to train an AI model. Only the coach ever reads what you wrote, and it reads it to answer you — not to build a profile for anyone else.
Transfers outside the UK
Where a provider processes data in the United States, the transfer is covered by the UK International Data Transfer Addendum and EU Standard Contractual Clauses in their data processing agreement, together with a transfer risk assessment we keep on file. Our database — where your answers actually live — is in the EU.
Questions: hello@sameside.co.uk.