Sub-processors.
Version: 1.0, 24 October 2026. Approved by Vitalos Technologies Limited.
These are the third parties that process personal data for Askbridge. Customer data (the database and file storage) is stored in the UK, and the application runs in London; the rows below explain what each provider sees and where.
Core sub-processors
| Provider | Purpose | Personal data involved | Location |
|---|---|---|---|
| Supabase | Database and file storage | All customer data: visitor conversations and contact details, users' accounts, knowledge (pages, files, FAQs), audit log | United Kingdom: London region (AWS eu-west-2) |
| Vercel | Hosting the Askbridge application and APIs | All data passing through requests (dashboard, inbox, visitor messages); request logs including IP addresses | Application functions in London (lhr1); a global edge network routes requests and serves static files |
| Anthropic | AI model that writes answers and conversation summaries | Redacted visitor messages and recent history; extracts of the customer's content; the customer's instructions. Never names, email addresses, contact details, IP addresses or device data | United States and possibly other regions |
| Cloudflare | Turnstile bot check in the widget | IP address, browser and device signals used for the bot check | Global network |
| Resend | Sending notification and account emails (hand-offs, email confirmation and password reset, invitations, billing and usage notices, daily summaries); for workspaces that switch on the email channel, receiving the customer's forwarded support emails and sending the team's replies | Users' names and email addresses; notification content, which can include a visitor's name and the first part of their message; for the email channel, the sender's name and email address, the email's subject, text and attachment names | EU (eu-west-1) |
| Stripe | Subscription billing, invoices, payment collection, customer billing portal | Customers' billing contacts, addresses and VAT numbers; card details are collected and held by Stripe, not by Askbridge | Ireland, United States and other regions |
Where a provider processes personal data outside the UK, the transfer is made under appropriate safeguards, such as UK adequacy regulations or the UK International Data Transfer Addendum, as set out in the data processing agreement, clause 11.
Connected by a customer
These are used only for a workspace whose owner or admin connects them, with the customer's own account.
| Provider | Purpose | Personal data involved |
|---|---|---|
| Cal.com | Booking viewings and callbacks in the customer's own Cal.com calendar, when the visitor chooses a time in the chat | The visitor's name, email address, phone number and time zone, and the chosen time; booking updates (rescheduled, cancelled) sent back to Askbridge |
Other integrations shown in the dashboard (Slack, Google Drive, HubSpot, Calendly and Microsoft Outlook Calendar) are not available yet. We will add each one to this page before it is switched on.
Outbound webhooks (n8n, Zapier, Make or the customer's own server) send event data to an address the customer chooses. They are the customer's own systems, not Askbridge's sub-processors.
Not sub-processors
- Embeddings for search are computed inside the Askbridge application, or not used; no third party receives the content for this.
- Fonts are self-hosted with the application; no request goes to Google Fonts at runtime.
- Browser push services (chosen by each user's browser) deliver dashboard notifications to users who switch them on. The notification content is encrypted end to end, so the push service cannot read it.
- GitHub holds source code, not customer data.
- Error monitoring and product analytics are not used.
Changes
We give at least 30 days' notice of new or replacement sub-processors to workspace owners by email, as set out in the data processing agreement.