Sub-processors
To operate our Services securely and reliably, Bleepy engages a small number of trusted third-party providers that process personal data on our behalf.
Overview
To operate our Services securely and reliably, Bleepy ("we," "us," or "our") engages a small number of trusted third-party providers ("sub-processors") that process personal data on our behalf.
We only use sub-processors that:
- Meet security, privacy, and compliance standards consistent with UK GDPR and EU GDPR;
- Operate under written data-processing terms; and
- Provide appropriate technical and organisational safeguards, including, where data leaves the UK, UK adequacy regulations or the UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU Standard Contractual Clauses.
This list reflects our current sub-processors and may change as our Services evolve.
1. Infrastructure and hosting
| Provider | Purpose | Region of processing | Safeguards |
|---|---|---|---|
| Supabase | Database and file storage only. Sign-in is NextAuth (session cookie), not Supabase Auth. | UK (London) | DPA signed; data stored in the London region |
| Vercel Inc. | Website hosting and deployment, and anonymous page-speed measurement | Global (edge network) | DPA signed, SCCs and regional routing controls |
| Cloudflare, Inc. | DNS for bleepy.co.uk | Global (data centres worldwide) | DPA signed, GDPR-compliant, SCCs in place |
2. Communications
| Provider | Purpose | Region of processing | Safeguards |
|---|---|---|---|
| Microsoft 365 / Azure | Email services and certificate delivery | EU / UK | DPA automatically included in Microsoft Online Services Terms |
| Browser push services (Google, Mozilla, Apple, Microsoft) | Deliver push notifications you have switched on; the message content is encrypted | The browser maker's own service | The service sees only where to deliver each message and when, not what it says |
3. AI, analytics and location services
| Provider | Purpose | Region of processing | Safeguards |
|---|---|---|---|
| OpenAI | Optional AI features, which each organisation can switch off: help drafting text, reading uploaded timetables and documents, describing pictures, summarising feedback, suggesting curriculum links, and answering questions from Bleepy's help articles and about reports. Only the text or picture sent for that task. No patient data. | US | DPA signed, SCCs in place. Not used to train OpenAI's models; kept by OpenAI for up to 30 days to check for misuse |
| Google Analytics | Website analytics and usage statistics | US / EU | SCCs and GDPR-compliant processing |
| Google Maps / Places | Maps on event pages, and finding a venue when staff set up events and organisations | US / EU | Google Cloud DPA / CDPA accepted; SCCs |
| Google reCAPTCHA | Bot protection on the contact, site-feedback and create-account forms (on the sign-in page, only once the create-account form is opened) | US / EU | Google Cloud DPA / CDPA accepted; SCCs |
| OpenWeather | Signed-in dashboard weather for the organisation location | EU / US | No account personal data; city or coordinates only |
| OpenStreetMap Nominatim | Finding the town staff type when they set the organisation's location for the dashboard weather, when OpenWeather finds nothing; called from our server | UK / EU | No personal data; only the place name typed |
4. Payments
| Provider | Purpose | Region of processing | Safeguards |
|---|---|---|---|
| Stripe, Inc. / Stripe Payments UK Ltd | Card payments for paid teaching events via Stripe Connect. Card numbers stay at Stripe and never hit Bleepy. | EU / UK / US (Stripe) | DPA, PCI DSS. The organisation is the merchant. Bleepy does not store card data. |
Updates
We review our sub-processors periodically and update this page as needed.
Material changes are communicated to organisational customers where required by agreement.
The “Last updated” date above shows the most recent revision.
Contact
For questions about our sub-processors, please contact us at:
Email: support@bleepy.co.uk
This sub-processors list is effective as of 19 November 2025 and was last updated on 30 October 2026.