Data protection
Sub-processors
These suppliers process data on our behalf. Last updated: 12 October 2026.
| Provider | Purpose | Data involved | Location |
|---|---|---|---|
| Lovable Cloud (built on Supabase, hosted on Amazon Web Services) | Application hosting, database, file storage, sign-in | All account data, including uploaded documents and login details | Database: Europe (Stockholm). Files: held on the same platform. Provider personnel may be outside the UK/EEA |
| Cloudflare | Network delivery and protection; all traffic passes through it | Traffic data (such as IP address); content in transit | Global network |
| Stripe | Payments and subscriptions | Name, email, payment details (full card numbers never reach us) | Stripe's global infrastructure |
| Resend | Sending emails (invitations, reminders, digests) | Recipient address and email content. Emails do not contain documents or verification answers | Resend's infrastructure |
| Google (optional) | Google sign-in, only if the user chooses it | Name and email address | Google's locations |
| Lovable AI (using OpenAI models) | Generating optional AI suggestions for policy wording and form drafts | Policy text and business profile details you enter, only when you use AI tailoring | Location depends on the provider's infrastructure; details available on request |
| Cloudflare Turnstile | Spam and bot protection on public forms and sign-up | Technical data such as IP address and browser details | Global |
We do not use analytics providers. We use an AI provider only for the optional policy tailoring tool described in our Privacy Policy, and never on customer records or documents. If this changes, we will update this list and give notice before the change takes effect.