Sub-processors
Last reviewed: 7 August 2026
ReadyGDPR uses the sub-processors listed below to provide the service. This list was reviewed against the codebase on 7 August 2026. Customers will be notified before a new sub-processor is added.
| Sub-processor | Purpose | Data it processes | Location |
|---|---|---|---|
| Supabase (via Lovable Cloud) | Application database, authentication, file storage and server functions | Account details, organisation records, compliance records, data subject requests and their attachments, audit logs, Virtual DPO conversations | To be confirmed |
| Vercel | Hosting and delivery of readygdpr.com | Request metadata including IP address and browser user agent. Serves the static application only — customer records are not stored here | To be confirmed |
| Cloudflare | Network delivery and protection in front of readygdpr.com and the application API | Request metadata including IP address, for both website and application API traffic | To be confirmed |
| Stripe | Payment processing and subscription billing | Billing name, email address, billing address and payment details, for paying organisations only | To be confirmed |
| Lovable | Delivery of transactional email | Recipient email address and the content of the message sent | To be confirmed |
| Anthropic | Provides the AI model (Claude) used by every AI feature: the Virtual DPO, policy and organisation document generation, breach notification drafting, data-mapping suggestions, dynamic checklist generation, website scanning, setup analysis and blog assistance. We send requests directly to api.anthropic.com on our own API key | Your Virtual DPO conversation content, and the organisation and record content relevant to whichever other feature you use (see the note below) | To be confirmed |
Supabase (via Lovable Cloud)
Purpose: Application database, authentication, file storage and server functions
Data it processes: Account details, organisation records, compliance records, data subject requests and their attachments, audit logs, Virtual DPO conversations
Location: To be confirmed
Vercel
Purpose: Hosting and delivery of readygdpr.com
Data it processes: Request metadata including IP address and browser user agent. Serves the static application only — customer records are not stored here
Location: To be confirmed
Cloudflare
Purpose: Network delivery and protection in front of readygdpr.com and the application API
Data it processes: Request metadata including IP address, for both website and application API traffic
Location: To be confirmed
Stripe
Purpose: Payment processing and subscription billing
Data it processes: Billing name, email address, billing address and payment details, for paying organisations only
Location: To be confirmed
Lovable
Purpose: Delivery of transactional email
Data it processes: Recipient email address and the content of the message sent
Location: To be confirmed
Anthropic
Purpose: Provides the AI model (Claude) used by every AI feature: the Virtual DPO, policy and organisation document generation, breach notification drafting, data-mapping suggestions, dynamic checklist generation, website scanning, setup analysis and blog assistance. We send requests directly to api.anthropic.com on our own API key
Data it processes: Your Virtual DPO conversation content, and the organisation and record content relevant to whichever other feature you use (see the note below)
Location: To be confirmed
Which AI provider handles the AI features
One provider — Anthropic. The Virtual DPO, policy and organisation document generation, breach notification drafting, data-mapping suggestions, dynamic checklist generation, website scanning, setup analysis and blog assistance all send their requests to Anthropic's Claude model, directly to api.anthropic.com on our own API key. No other AI provider is involved in any feature. For the Virtual DPO, alongside your message we include context about your organisation so the guidance is relevant: your organisation's name, industry, size and region, the categories of data you have recorded, your recorded processing activities, and your progress through your compliance checklist. The other features send the organisation and record content relevant to what you are generating.
Anthropic's published position on training, checked on 7 August 2026: "By default, we will not use your inputs or outputs from our commercial products (e.g. Claude for Work, Anthropic API, Claude Gov, etc.) to train our models." The exception is content a user explicitly submits as feedback. ReadyGDPR does not submit your conversations or generated content to Anthropic as feedback.
If you do not want this information leaving ReadyGDPR, do not use the AI features. Every other part of the product works without them.
Still being confirmed
The following are not yet documented and will be published once confirmed:
- the hosting region for each sub-processor
- whether a data processing agreement is in place with each sub-processor, and the transfer mechanism used where data leaves the UK/EEA
- retention periods at each sub-processor
- how long Anthropic retains conversation and request content
We would rather publish an incomplete list honestly than a complete-looking one we cannot stand behind.
Questions
To ask about any of this, email [email protected].