Sub-processors
Everyone who touches your data.
This is the complete list. Each service has one job and receives only what that job needs. If we add or replace one, we will email you at least 14 days before it takes effect.
Last updated 6 August 2026
Running the product
Vercel
US company. Operelio's code runs in London (lhr1)
Hosts the website and the app.
Receives: Every request, including IP address and browser.
Transfers covered by: EU-US Data Privacy Framework, including the UK Extension.
Neon
London (AWS eu-west-2). US company, Neon Inc.
Runs the database.
Receives: Account details, job records, file records.
Cloudflare
European Union (EU jurisdiction bucket). US company, Cloudflare, Inc.
Stores uploaded files and outputs (R2).
Receives: Your files.
Railway
Amsterdam, Netherlands. US company, Railway Corporation
Runs the worker that processes files.
Receives: Your files while a job is running.
Account and billing
Clerk
United States (Clerk, Inc.)
Sign-in, sessions and multi-factor authentication.
Receives: Email address, name, authentication tokens.
Transfers covered by: EU-US Data Privacy Framework, including the UK Extension.
Stripe
United States (Stripe, LLC)
Payments and subscriptions.
Receives: Billing email, and card details entered directly into Stripe's forms.
Transfers covered by: EU-US Data Privacy Framework, including the UK Extension.
Communication
Resend
United States (Plus Five Five, Inc.)
Sends transactional and product emails.
Receives: Email address, name, and the contents of the email.
Transfers covered by: EU-US Data Privacy Framework, including the UK Extension.
tawk.to
United States (tawk.to Inc.)
Live chat and the support inbox.
Receives: Chat messages, and support messages sent to us.
Transfers covered by: Standard Contractual Clauses, as amended by the UK Addendum.
Product
OpenAI
United States (OpenAI OpCo, LLC)
Supplies the language model behind Bridgeant: it reads your request and drafts a plan for you to approve. The cleaning, matching and CRM mapping then run on Operelio's own worker.
Receives: The messages you type, a structural summary of your file (column headers, fill rates, row and column counts, quality issues), and the names of your files, sheets, saved workflows, mappings and schemas. Never cell values.
Transfers covered by: Standard Contractual Clauses, as amended by the UK Addendum.
PostHog
European Union
Product analytics.
Receives: Email, name, plan, pages visited, IP address at collection, and your onboarding answers.
Email verification
MillionVerifier
European Union (Hungary and Sweden)
First-pass email verification.
Receives: The email addresses in your file.
Bouncer
European Union
Deeper second-pass verification.
Receives: Email addresses that need a closer check.
RDAP and public DNS
Global
Checking whether a domain is real and active.
Receives: The domain part of an email address, never the address.
About the transfer lines above. There is no general adequacy decision for the United States, so each US company needs its own lawful basis. Four of them are certified under the EU-US Data Privacy Framework and its UK Extension, which the UK government recognizes. The other two are covered by Standard Contractual Clauses with the UK Addendum, which we hold through their data processing agreements. We check these when the list changes, because a certification can lapse.
US companies running UK and EU infrastructure. Neon, Cloudflare and Railway are US-headquartered, but the service we buy from each runs in the region shown, so your data does not leave the UK and the EU in normal operation. Each one's data processing agreement incorporates the Standard Contractual Clauses with the UK Addendum as a safeguard in any case. The RDAP and public DNS lookups receive only the domain part of an address, which is queried against public directory infrastructure rather than sent to a contracted company.
Your files stay in the UK and the EU. They are created, stored and processed entirely inside the UK and the EU. Where a US company appears in the list above, it is the operator of infrastructure running in the UK or the EU (Vercel serves Operelio from London), or it receives account and billing data rather than files. One payload from your file does go to the United States: when you use Bridgeant, the structural summary described above is sent to OpenAI so it can plan the work. Your cell values are never sent, and you can see exactly what was sent under any Bridgeant reply.
Your CRM is not a sub-processor. When you push data to HubSpot, Salesforce or Pipedrive, that platform becomes an independent controller of the data you sent it, under its own privacy policy.
Full detail on our obligations as your processor is in our Data Processing Agreement.