SUB-PROCESSORS
Who else processes your data.
A public list of every third-party service AI Twin uses to operate. What they do, where they process data, and whether we have a data processing agreement in place with each one.
Last updated 10 July 2026
WHAT THIS IS
Transparency, not boilerplate.
Under UK GDPR Article 28, any service that processes personal data on our behalf is our “data processor”. This page lists every one of them. We update it when anything changes.
Each entry shows what the processor does, where in the world it processes data, and whether we have a written Data Processing Agreement (DPA) in place with them. Where a processor handles personal data, a DPA is legally required. Where it does not, a DPA is documented anyway as good practice.
THE LIST
Every sub-processor we use.
Anthropic
- Purpose
- LLM provider for product features
- Region
- European Union (Anthropic EU region)
- DPA Status
- DPA in progress
Vertex AI (Google Cloud)
- Purpose
- Additional LLM and speech-to-text services
- Region
- European Union
- DPA Status
- DPA in progress
Supabase
- Purpose
- Database hosting for waitlist and contact records
- Region
- European Union
- DPA Status
- DPA in progress
Stripe
- Purpose
- Payment processing (when product launches)
- Region
- European Union and United Kingdom
- DPA Status
- DPA in progress
Brevo (Sendinblue SAS)
- Purpose
- Transactional and waitlist email (feedback, support, waitlist notifications)
- Region
- European Union (Paris, France)
- DPA Status
- DPA in progress
Sentry
- Purpose
- Error and performance monitoring
- Region
- European Union
- DPA Status
- DPA in progress
Cloudflare
- Purpose
- DNS, CDN, DDoS protection
- Region
- Global edge network with EU residency option
- DPA Status
- DPA in progress
Plausible Analytics
- Purpose
- Privacy-friendly aggregate analytics
- Region
- European Union (Estonia)
- DPA Status
- DPA in progress
Lovable Cloud
- Purpose
- Website hosting and deployment
- Region
- European Union
- DPA Status
- DPA in progress
STATIC ASSET HOSTS
Where the homepage demo files come from.
The on-device demo on our homepage uses two static file hosts to deliver the embedding model and runtime to your browser. These are not sub-processors of your personal data, they never see your queries, but we name them for transparency.
Hugging Face
- What they host
- The embedding model (Xenova/all-MiniLM-L6-v2, ~22MB)
- Region
- United States (CDN distributed)
- What they see
- A browser somewhere downloaded a public model file
jsDelivr
- What they host
- The ONNX runtime WebAssembly files
- Region
- Distributed CDN (region varies)
- What they see
- A browser somewhere downloaded public runtime files
These hosts apply only to the homepage demo. The full AI Twin product (when you sign in) uses the sub-processor list above and does not download files from these CDNs. If we ever change this for the full product, this page will be updated and waitlist members will be notified.
REQUESTS
If you want the underlying paperwork.
DPAs are available on request to professional buyers, prospective customers conducting their own due diligence, and data subjects exercising their information rights under UK GDPR.
Email hello@ai-twin.co.uk with “Sub-processor DPA request” in the subject line. We aim to respond within five working days for due diligence requests, and within one month for formal data subject requests as required by UK GDPR.
CHANGES
When we update sub-processors.
We update this page when we add, remove, or change a sub-processor. For waitlist members, we email you about material changes (a new processor, or a change in processing region for an existing processor) before the change takes effect. For visitors to the site, the updated list applies from the date it is published here.