Sub-Processors
To operate our Services securely and reliably, Bleepy engages a small number of trusted third-party providers that process personal data on our behalf.
Overview
To operate our Services securely and reliably, Bleepy ("we," "us," or "our") engages a small number of trusted third-party providers ("sub-processors") that process personal data on our behalf.
We only use sub-processors that:
- Meet security, privacy, and compliance standards consistent with UK GDPR and EU GDPR;
- Operate under written data-processing terms; and
- Provide appropriate technical and organisational safeguards, including, where data leaves the UK, UK adequacy regulations or the UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU Standard Contractual Clauses.
This list reflects our current sub-processors and may change as our Services evolve.
1. Infrastructure and Hosting
| Provider | Purpose | Region of Processing | Safeguards |
|---|---|---|---|
| Supabase | Database and file storage only. Sign-in is NextAuth (session cookie), not Supabase Auth. | EU / UK (Ireland and London regions) | DPA signed, data remains in EU/UK data centres |
| Vercel Inc. | Website hosting and deployment | Global (edge network) | DPA signed, SCCs and regional routing controls |
| Cloudflare, Inc. | CDN, DNS, DDoS protection, and SSL/TLS services | Global (edge network with data centers worldwide) | DPA signed, GDPR-compliant, SCCs in place |
2. Authentication and Communications
| Provider | Purpose | Region of Processing | Safeguards |
|---|---|---|---|
| Microsoft 365 / Azure | Email services and certificate delivery | EU / UK | DPA automatically included in Microsoft Online Services Terms |
3. AI and Analytics Services
| Provider | Purpose | Region of Processing | Safeguards |
|---|---|---|---|
| OpenAI | Event spreadsheet extraction and feedback advanced reports | US | DPA signed, SCCs in place |
| Google Analytics | Website analytics and usage statistics | US / EU | SCCs and GDPR-compliant processing |
| Google Maps / Places | Event and organisation location lookup | US / EU | Google Cloud DPA / CDPA accepted; SCCs |
| Google reCAPTCHA | Bot protection on contact, register, and site-feedback forms | US / EU | Google Cloud DPA / CDPA accepted; SCCs |
| OpenWeather | Signed-in dashboard weather for the organisation location | EU / US | No account personal data; city or coordinates only |
4. Payments
| Provider | Purpose | Region of Processing | Safeguards |
|---|---|---|---|
| Stripe, Inc. / Stripe Payments UK Ltd | Card payments for paid teaching events via Stripe Connect. Card numbers stay at Stripe and never hit Bleepy. | EU / UK / US (Stripe) | DPA, PCI DSS. The organisation is the merchant. Bleepy does not store card data. |
Updates
We review our sub-processors periodically and update this page as needed.
Material changes are communicated to organisational customers where required by agreement.
The "Effective Date" above reflects the most recent revision.
Contact
For questions about our sub-processors, please contact us at:
Email: support@bleepy.co.uk
This Sub-Processors list is effective as of 19 November 2025 and was last updated on 1 October 2026.