TradersFlowOverview
A sub-processor is a third party we engage to process personal data on our behalf to provide TradersFlow. Each sub-processor is bound by contractual data-protection terms (including, where applicable, the UK Addendum and Standard Contractual Clauses for international transfers) and is selected for its security and compliance posture.
We may update this list when we add, replace or remove a sub-processor. Material changes are announced in advance by email or in-app notice to subscribed customers.
Current sub-processors
| Provider | Purpose | Categories of data | Location |
|---|---|---|---|
| Google LLC (Google Play Billing) | Subscription billing and payment collection for purchases made inside the TradersFlow Android app. | Google Play purchase token, order ID, subscription state, obfuscated Google account identifier (card details are entered into Google Play directly and never reach TradersFlow). | Global (Google Play operates globally; EU data protection terms apply). |
| RevenueCat, Inc. | Subscription infrastructure for the Android app — validates Google Play purchases, tracks entitlements, and notifies TradersFlow of subscription lifecycle events by webhook. | App user identifier linked to your TradersFlow account ID, purchase token, product/plan and entitlement identifiers, subscription status, purchase and renewal dates. | United States (Standard Contractual Clauses and UK Addendum apply). |
| OpenAI, L.L.C. / OpenAI Ireland Ltd | Generates the text for the AI features you choose to use: Ask TradersFlow answers, Automated Business Insights explanations, and Create with AI drafts. Requests are made server-side by TradersFlow over the OpenAI API. | The prompt or question you type, plus the limited business context needed to answer it — business and tax settings, finance totals, invoices, quotes, jobs, expenses, suppliers, purchases, stock figures and customer or supplier names. Customer contact details, bank details and tax identifiers are excluded. API content is not used to train OpenAI's models. | United States (Standard Contractual Clauses and UK Addendum apply). |
| Supabase, Inc. (hosted on AWS) | Primary database, authentication, file storage and serverless functions. | Account credentials (hashed), profile and business information, customer records, jobs, quotes, invoices, photos and documents, application logs. | AWS EU regions (eu-west). |
| Cloudflare, Inc. | DNS, edge networking, TLS termination, DDoS and bot protection, static asset delivery. | Request metadata (IP address, user-agent, request paths, timing). No business records are stored by Cloudflare beyond transient edge caching. | Global edge network. |
| Resend (Lovable Email infrastructure) | Delivery of transactional emails (verification, password reset, trial reminders, invoices, payment notices) and delivery event reporting (delivered, opened, clicked, bounced, complained, unsubscribed). | Recipient email address, sender, subject, rendered email body, delivery and engagement events. | EU / US. |
| Lovable (hosting & deployment platform) | Application hosting, edge runtime for server functions, deployment pipeline. | Application code, build artefacts, request logs, error traces. | EU / global edge. |
| Google Maps Platform / Places API (Google) | Address autocomplete when you type an address into the app. | The address characters you type, plus the IP address, device and browser information Google receives with the request. Google acts as an independent controller for this data. | Global (Google infrastructure). |
International transfers
Where a sub-processor stores or accesses personal data outside the UK or EEA, we rely on adequacy decisions or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses to safeguard the transfer.
Questions
Questions about a specific sub-processor, or to request our Data Processing Addendum: privacy@tradersflow.co.uk.