Subprocessors
The third parties that process personal data on our behalf, and the safeguard covering each transfer.
- Effective
- 14 October 2026
- Applies to
- Vorniqe
About this list
We use a small number of providers to run our services. Each processes personal data only on our instructions, under written terms meeting Article 28 of the UK GDPR. This list is maintained as data rather than prose, so it is accurate on the day you read it.
We give at least 30 days’ notice before adding or replacing a subprocessor. To be told by email, write to [email protected]. The same list is available as JSON at https://drentova.com/legal/api/v1/subprocessors if you would rather monitor it automatically.
Subprocessors
| Subprocessor | Purpose | Location | Transfer safeguard | Data |
|---|---|---|---|---|
| Cloudflare | Content delivery, firewall, DDoS protection and bot checks | United States | UK Addendum to the EU SCCs | IP address, browser and device details, and the content of requests passing through its network |
| Firebase Cloud Messaging | Delivering notifications to the mobile app | United States | UK Addendum to the EU SCCs | Device notification token and notification content |
| Google Cloud | Self-hosted database hosting, for customers who choose to keep their data in the Middle East | Saudi Arabia (Dammam) or Qatar (Doha), as the customer chooses | UK Addendum to the EU SCCs | All application data, including account details and submitted content |
| Google Cloud (Speech-to-Text and Vertex AI) | Turning voice notes into text, and the AI model that suggests how to file them | European Union | UK adequacy regulations | Voice note audio, discarded once transcribed, and the resulting text |
| Hostinger | Self-hosted database and application hosting (default location) | India (Mumbai) | UK Addendum to the EU SCCs | All application data, including account details and submitted content |
| Oracle Cloud Infrastructure | Self-hosted database hosting, for customers who choose to keep their data in the Middle East | Saudi Arabia (Riyadh) | UK Addendum to the EU SCCs | All application data, including account details and submitted content |
| Resend | Transactional email delivery | United States | UK Addendum to the EU SCCs | Recipient email address and message content |
| Sentry | Crash and error reporting for the mobile app | European Union (Germany) | UK Addendum to the EU SCCs | Error details, app version, device details and an internal account number |
| Vercel | Application hosting, content delivery and file storage | United States | UK Addendum to the EU SCCs | IP address, request metadata and server logs; uploaded media stored in Vercel Blob |
International transfers
We are based in the United Kingdom and process personal data here wherever we can. Some of the providers we rely on operate outside the UK.
Where personal data is transferred outside the UK, we rely on one of the safeguards permitted by Chapter V of the UK GDPR: UK adequacy regulations, the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. The safeguard applying to each provider is named in the subprocessor table, and we carry out a transfer risk assessment before relying on any of them.
You can ask us for a copy of the safeguards in place for a particular transfer by writing to [email protected].
How to contact us
- Privacy and data protection
- [email protected]