LEGAL
Sub-processors
Last updated: 12 August 2026
This page lists the third-party service providers (“sub-processors”) that we engage to deliver the Alivio service. Each sub-processor has been reviewed for its data protection and security practices and processes personal data on our behalf under contractual terms at least as protective as our own.
We update this page when we change sub-processors. Where reasonably possible we give 30 days’ notice. Customers can subscribe to changes by emailing privacy@alivio.org.uk.
Current sub-processors
| Provider | Purpose | Location | Safeguards |
|---|---|---|---|
| Supabase | Database, authentication, file storage | United Kingdom (London, eu-west-2) | UK GDPR–compliant region; DPA in place; data remains in the UK |
| Cloudflare | DNS, CDN, security (WAF), email forwarding | Global, with EU data residency for cache | DPA in place; UK-approved transfer mechanisms |
| Vercel | Web and application hosting | United States (with EU edge regions) | DPA in place; EU-US Data Privacy Framework participant; UK International Data Transfer Agreement |
| Stripe | Payment processing and subscription billing (your name, email address, and billing address). Card details are entered directly into Stripe’s hosted checkout and never reach our systems | United States, with processing in the UK and EU | Stripe Data Processing Agreement in place; EU-US Data Privacy Framework participant; UK International Data Transfer Agreement; PCI DSS Level 1 certified |
| Resend | Transactional email delivery (account emails such as invitations and password resets, and waitlist notifications) | EU (Ireland, eu-west-1) | DPA in place; data does not leave the EU |
| PostHog | Product analytics for the Alivio app (usage events linked to a pseudonymous account identifier; no names, emails, or free-text content) | EU (Frankfurt) | DPA in place; EU region; pseudonymous identifiers only; not used for cross-app tracking |
| Expo (Expo Application Services) | Push notification delivery for the mobile apps (device push tokens and the content of the notification, which can include a horse’s name) | United States | DPA in place under Expo’s data processing terms; UK International Data Transfer Agreement |
| Google (Firebase Cloud Messaging) | Delivery of push notifications to Android devices. Firebase Cloud Messaging only — we do not use Google Analytics, Firebase Analytics, or Crashlytics | United States | Google Cloud DPA in place; EU-US Data Privacy Framework participant; UK International Data Transfer Agreement |
| Apple (Apple Push Notification service) | Delivery of push notifications to iPhone and iPad | United States | Processed under the Apple Developer Program Licence Agreement; EU-US Data Privacy Framework participant |
| GitHub | Source code hosting (no customer data) | United States | No customer personal data processed; included for transparency |
How to be notified of changes
Email privacy@alivio.org.uk with the subject line “Sub-processor change notifications” and we will add you to the notification list.
Questions
For any questions about our sub-processors or the safeguards in place, email privacy@alivio.org.uk.