Sub-processor List

Version Live·Effective Updated automatically·Questions? privacy@norynsystem.com

We are required under Article 28 UK GDPR to disclose all sub-processors — third-party companies that process personal data on our instructions. We will give you 30 days' notice by email before adding any new sub-processor. You may object by emailing privacy@norynsystem.com — if you object and we cannot accommodate your objection, you may terminate your subscription.

Current Sub-processors

Anthropic

Added July 2026

United StatesSCCs + UK Addendum (incorporated into Anthropic Commercial Terms)

AI model inference — generates message text, reply drafts, scheduling suggestions, and lead classification via Claude models

Conversation contentSystem promptsVoice samplesFAQ context

View DPA →

Supabase

Added July 2026

United States (EU region available)SCCs + UK Addendum

Database, authentication, and file storage — stores all platform data including account info, employee configuration, and conversation logs

Account dataEmployee configurationConversation logsAudit logsOAuth tokens (encrypted)

View DPA →

Stripe

Added July 2026

United States / Ireland (EU)SCCs

Payment processing — handles subscription billing, invoices, and payment method storage

Billing dataPayment methodsInvoice recordsBusiness contact details

View DPA →

Vercel

Added July 2026

United States (global edge)SCCs + UK Addendum

Application hosting and edge network — serves the platform and processes all in-transit data

All in-transit request dataServer-side logsIP addresses

View DPA →

Resend

Added July 2026

United StatesSCCs

Transactional email delivery — sends notifications, welcome emails, privacy request confirmations, and breach notifications

Email addressesEmail contentDelivery metadata

View DPA →

Meta (Facebook / Instagram)

Added July 2026

United StatesSCCs (per Meta Business Tools Terms)

Messaging integration — when customers connect their Facebook Page or Instagram Business account, lead messages flow through Meta's API

Lead messagesProfile identifiersConversation content

View DPA →

Google (Gmail / Calendar)

Added July 2026

United StatesSCCs (per Google Cloud DPA)

Email and calendar integration — when customers connect their Google Workspace, the platform reads/sends emails and manages calendar events on their behalf

Email contentCalendar eventsContact names

View DPA →

Microsoft (Outlook / Teams)

Added July 2026

United States / EUSCCs + UK Addendum (per Microsoft DPA)

Email and calendar integration — when customers connect their Microsoft 365 account, the platform reads/sends emails and manages calendar events on their behalf

Email contentCalendar eventsContact names

View DPA →

What "Transfer Mechanism" Means

Most of our sub-processors are based in the United States. Because the UK and US do not have an adequacy decision covering all transfers, we rely on Standard Contractual Clauses (SCCs) with the UK Addendum as the legal basis for transferring personal data outside the UK. Each sub-processor's DPA incorporates appropriate SCCs.

Notification of Changes

We will notify all organisation owners by email at least 30 days before adding a new sub-processor or making a significant change to an existing one. The effective date will be stated in the notification. You have the right to object within that 30-day window.

Historical Changes

A record of sub-processor additions and removals is maintained for audit purposes. Enterprise customers may request this history by emailing privacy@norynsystem.com.

Noryn · Noryn System Ltd · ICO Reg [ICO reg. no.] · privacy@norynsystem.com