Trust centre
Sub-processors.
The providers that may process personal data on our behalf. Platforms we build on for you, such as your CRM or cloud account, are your own providers under your contracts with them, so they are not listed here.
Last reviewed 22 October 2026. Questions: hello@smallbaydigital.com
Running SBD and client engagements
These providers may process client contact details or project material while we deliver an engagement.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Google Workspace | Email, calendar and documents | Contact details, correspondence, project documents | United States and global Google data centres |
| GitHub | Source code hosting for builds before handover | Source code; test data where unavoidable | United States |
| Anthropic | AI assistance in engineering, and translation of this website | Code and text sent in a request; not used to train models under commercial terms | United States |
| Supabase | Our CRM for enquiries and client records | Contact details and enquiry content | AWS region chosen for the project |
| Zoho Books | Invoicing | Billing contact and company details | India |
This website
These providers process data from visitors to smallbaydigital.com.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Vercel | Hosting and form endpoints | Request data, form submissions in transit | United States, with a global edge network |
| Resend | Delivers form submissions to our inbox | Form contents | United States |
| Cal.com | Booking calls | Name, email and booking notes | United States |
| Fillout | Audit request form | Form contents | United States |
| Google Analytics | Aggregate usage, only after cookie consent | Pseudonymous usage data | United States |
| Vercel Analytics | Aggregate, cookie-free page statistics | Anonymised page views | United States |
| Google Fonts | Serves the typeface | IP address and browser details in the font request | United States |
Changes to this list
Clients with a data processing addendum are told by email at least 30 days before we add or replace a sub-processor, and may object on reasonable data-protection grounds. To be notified, email hello@smallbaydigital.com with the subject "Sub-processor updates".
Transfers outside the UK and the European Economic Area rely on the EU Standard Contractual Clauses or the UK International Data Transfer Addendum. Transfers from India go only to countries not restricted under the Digital Personal Data Protection Act 2023.