Sub-processors
Last updated: 15 September 2026
Birdly uses external suppliers to operate the Service.
Where a supplier processes Customer Personal Data on Birdly's behalf as part of Birdly's processor role, it may be a sub-processor. Other suppliers may act as independent controllers for some processing, for example certain payments or advertising activities.
Current UK providers — VERIFY BEFORE PUBLICATION
| Provider | Purpose | Primary processing/location information | Transfer basis / notes |
|---|---|---|---|
| Supabase | Database and backend | Primary Birdly database region: Paris, France (EEA) | UK→EEA adequacy where UK GDPR applies; verify provider DPA/onward access |
| Vercel | Website/application hosting and edge delivery | Multi-region/global depending on feature | Verify contracting entity and transfer safeguards |
| SureSMS | Text messages | Denmark (EEA) | DPA in place; same provider as the Danish service |
| Resend | Transactional/system email | EU/US depending on service | UK Addendum to the EU SCCs, or another approved safeguard |
| Frisbii | Subscription and payment management | Denmark/EEA | DPA in place |
| Clearhaus (Frisbii's acquirer) | Card acquiring | Denmark/EEA | May act as independent controller for parts of payment processing |
Do not include MobilePay unless the UK product actually uses it.
Meta belongs in Privacy/Cookies for advertising measurement; do not automatically label Meta a sub-processor unless the contractual role supports it.
Changes
Where the DPA applies, the Customer gives Birdly general authorisation to use sub-processors subject to the DPA. Birdly gives reasonable advance notice of a material new/replacement sub-processor where required, and the DPA explains the objection process.