← Noryn

Sub-processor List

Version LiveEffective 16 September 2026Questions? privacy@norynsystem.com
We are required under Article 28 UK GDPR to disclose all sub-processors — third-party companies that process personal data on our instructions. We will give you 30 days’ notice by email before adding any new sub-processor. You may object by emailing privacy@norynsystem.com — if you object and we cannot accommodate your objection, you may terminate your subscription.

Current Sub-processors

Anthropic

Added July 2026

United StatesSCCs + UK Addendum (incorporated into Anthropic Commercial Terms)

AI model inference — generates message text, reply drafts, scheduling suggestions, and lead classification via Claude models

Conversation contentSystem promptsVoice samplesFAQ context
View DPA →

Supabase

Added July 2026

United States (EU region available)SCCs + UK Addendum

Database, authentication, and file storage — stores all platform data including account info, employee configuration, and conversation logs

Account dataEmployee configurationConversation logsAudit logsOAuth tokens (encrypted)
View DPA →

Stripe

Added July 2026

United States / Ireland (EU)SCCs

Payment processing — handles subscription billing, invoices, and payment method storage

Billing dataPayment methodsInvoice recordsBusiness contact details
View DPA →

Vercel

Added July 2026

United States (global edge)SCCs + UK Addendum

Application hosting and edge network — serves the platform and processes all in-transit data

All in-transit request dataServer-side logsIP addresses
View DPA →

Upstash

Added August 2026

United States / EU (region selected per database)SCCs + UK Addendum (per Upstash DPA)

Rate limiting, duplicate-message suppression and short-term reply caching — stores short-lived counters keyed by caller IP address to throttle sign-in and inbound webhook abuse; stores provider message identifiers so a redelivered message is answered only once; and, for businesses using the public API directly, holds the virtual employee's reply for up to 24 hours so a timed-out retry collects the same answer instead of triggering a second run

IP addressesMessage identifiersConversation identifiersMessage content (virtual employee replies)Hashed message and contact identifiers
View DPA →

Slack

Added September 2026

United StatesSCCs + UK Addendum (per Slack/Salesforce DPA)

Messaging channel — when a customer connects Slack, inbound messages are received through the Events API and the virtual employee's replies are posted back with chat.postMessage, so conversation content passes through Slack

Conversation contentLead and customer messagesDisplay namesSlack workspace, channel and user identifiers
View DPA →

Resend

Added July 2026

United StatesSCCs

Transactional email delivery — sends notifications, welcome emails, privacy request confirmations, and breach notifications

Email addressesEmail contentDelivery metadata
View DPA →

Meta (Facebook / Instagram)

Added July 2026

United StatesSCCs (per Meta Business Tools Terms)

Messaging integration — when customers connect their Facebook Page or Instagram Business account, lead messages flow through Meta's API

Lead messagesProfile identifiersConversation content
View DPA →

Telegram

Added August 2026

United Arab Emirates (global infrastructure)Telegram Bot API terms — no processor DPA or SCCs offered (under review)

Messaging channel — when a customer connects a Telegram channel, inbound and outbound messages are delivered through the Telegram Bot API

Lead messagesConversation contentTelegram chat identifiersDisplay names
View DPA →

Twilio

Added August 2026

United States (global carriers)SCCs + UK Addendum

SMS channel — when a customer connects a Twilio number, inbound and outbound text messages are delivered through Twilio

Phone numbersSMS message contentDelivery metadata
View DPA →

Google (Gmail / Calendar)

Added July 2026

United StatesSCCs (per Google Cloud DPA)

Email and calendar integration — when customers connect their Google Workspace, the platform reads/sends emails and manages calendar events on their behalf

Email contentCalendar eventsContact names
View DPA →

Microsoft (Outlook)

Added July 2026

United States / EUSCCs + UK Addendum (per Microsoft DPA)

Email channel — when a customer connects an Outlook or Microsoft 365 mailbox over IMAP/SMTP, message content is read from and sent through Microsoft's mail servers

Email contentEmail addressesContact names
View DPA →

What “Transfer Mechanism” Means

Most of our sub-processors are based in the United States. Because the UK and US do not have an adequacy decision covering all transfers, we rely on Standard Contractual Clauses (SCCs) with the UK Addendum as the legal basis for transferring personal data outside the UK. Where a provider offers a processor DPA, it incorporates appropriate SCCs; where one does not, that provider’s transfer-mechanism label above says so.

Notification of Changes

We will notify all organisation owners by email at least 30 days before adding a new sub-processor or making a significant change to an existing one. The effective date will be stated in the notification. You have the right to object within that 30-day window.

Historical Changes

A record of sub-processor additions and removals is maintained for audit purposes. Enterprise customers may request this history by emailing privacy@norynsystem.com.

Noryn · Noryn System Ltd · Registered in England & Wales no. 17335896 · ICO Reg ZC199308

Registered office: 44 Bellbrigg Lonning, Cockermouth, CA13 9DA, United Kingdom · privacy@norynsystem.com