Sub-processors
Last updated 17 June 2026
Last Updated: 24 June 2026 · Version: 4.0
This page lists the third-party companies ("sub-processors") that process personal data on UNVL's behalf, the type of processing they carry out, where they process it, and the safeguard we rely on for any processing outside the UK or EEA. It is referenced from our Privacy Policy (Sections 5 and 11). We keep this page current; material additions are notified in line with Privacy Policy Section 14.
1. AI providers
We use established third-party AI providers to power our features. We do not train or host our own AI models.
| Provider | Type of processing | Data it receives | Processing region | Transfer safeguard |
|---|---|---|---|---|
| Anthropic, PBC | AI text processing | Messages, profile details and images you provide to AI-powered features | US | UK-US Data Bridge / IDTA |
| Google LLC | AI text and image processing | Short text inputs, and supplier portfolio images and videos | US | UK-US Data Bridge / IDTA |
| MongoDB, Inc. | Database hosting and AI text processing | All couple and supplier records (hosting); short text inputs for AI processing | Database: London (eu-west-2); AI models: US | UK cluster = no transfer; AI models under MongoDB DPA + DPF / IDTA |
| AssemblyAI, Inc. | AI voice transcription | Audio recordings (not stored by UNVL after transcription) | US | UK-US Data Bridge / IDTA |
| Amazon Web Services, Inc. | AI text processing | Short text and message inputs to AI features | EU (Frankfurt) | EEA processing; SCCs / IDTA as applicable |
| Cohere Inc. | AI text and image processing | Short text inputs and, where applicable, portfolio images | US or EU | Direct API: UK-US Data Bridge / IDTA; EU path: EEA processing |
What AI providers never receive: payment details, card numbers or billing information; account passwords or authentication tokens; and data obtained via Google OAuth scopes (including Google Calendar events, which are used only to derive a supplier's busy/free status and are never forwarded to any AI provider).
2. Infrastructure, operations and other processors
| Provider | Type of processing | Processing region | Transfer safeguard |
|---|---|---|---|
| Stripe, Inc. / Stripe Payments UK Ltd | Payment processing (we do not store card details) | UK / EU / US | Stripe Payments UK Ltd (FCA-authorised) + DPF / SCCs |
| Amazon Web Services, Inc. | Cloud hosting, storage and authentication | London (eu-west-2) | UK region = no transfer |
| Cloudflare, Inc. | Content delivery and media storage | Global edge / EU | SCCs + UK Addendum |
| Vercel, Inc. | Website hosting and product analytics | Global edge / US | DPF / SCCs |
| Resend (Plus Five Five, Inc.) | Email delivery (transactional and marketing) | US | UK-US Data Bridge / IDTA |
| Airtable, Inc. | Waitlist and registration records | US | UK-US Data Bridge / IDTA |
| Axiom, Inc. | Operational logging and diagnostics | US | IDTA / SCCs |
| Vimeo, Inc. | Supplier video hosting and playback | US | DPF / SCCs |
| Perplexity AI, Inc. | AI-assisted research to help build supplier profiles | US | UK-US Data Bridge / IDTA |
| Functional Software, Inc. (Sentry) | Error monitoring and diagnostics | US / EU | DPF / SCCs |
All sub-processors are bound by contract (a data processing agreement) to protect personal data and use it only on UNVL's documented instructions.
3. Questions
To ask about our sub-processors or our data-protection practices, contact privacy@unvl.co.
UNVL Sub-processors | Version 4.0 | 24 June 2026