Third parties that process personal data on behalf of SiteSinc customers. We provide 30 days notice before adding or replacing subprocessors. Contact dpo@sitesinc.co.uk to object on reasonable data protection grounds.
| Subprocessor | Purpose | Location | Data processed |
|---|---|---|---|
| Frankfurt hosting provider | Database and application hosting | Germany (EU) | All Service data |
| Cloudflare R2 | File and document storage | EU / US (region-dependent) | Uploaded documents and files |
| Stripe | Payment processing | United States / global | Billing contact, payment metadata |
| SendGrid | Transactional email delivery | United States | Email addresses, message content |
| OpenAI | Search embeddings for Project Assistant | United States | Chunked project text, chat queries (API — not used to train public models) |
| xAI | AI response generation for Project Assistant | United States | Chat messages, retrieved project context, and optional mailbox thread excerpts for follow-up suggestions |
| Microsoft (Microsoft Graph) | Optional personal Outlook mailbox and OneDrive / SharePoint integrations | United Kingdom / EU / global (per Microsoft data residency) | OAuth tokens; mailbox or file content the user selects to sync or import |
| Google (Analytics, Ads, GTM) | Website analytics and advertising | United States / global | Website usage on marketing pages |
| Vercel | Application hosting | United States / global | Request metadata, deployment logs |
AI subprocessors (OpenAI, xAI) process data in the United States. Optional Microsoft 365 integrations communicate with Microsoft Graph; location depends on your Microsoft 365 tenant configuration. Transfers are protected by the UK International Data Transfer Agreement (IDTA) and/or Standard Contractual Clauses with UK Addendum. Transfer Risk Assessments are maintained internally and reviewed annually.
Last updated: June 2026 · Data Processing Agreement