Sub-processor List
Version 1.0 — Last updated 6 August 2026
This page lists the third parties that CloudRev Intelligence Ltd engages to help provide MarginChief, and that may process personal data contained in customer data on our behalf.
It forms part of our Data Processing Agreement and is referred to in clauses 9.5 and 9.6 of our Terms and Conditions and in section 6 of our Privacy Policy. By entering into the DPA, you give general authorisation for us to engage the sub-processors listed here.
Current sub-processors
| Sub-processor | Purpose | Country of processing | Transfer safeguard |
|---|---|---|---|
| Google Cloud EMEA Limited / Google LLC — application infrastructure | Hosting the application at app.marginchief.com on Google Compute Engine, together with the application database and Cloud Logging for request, traffic and error logs. This is where customer data lives. | United Kingdom region (europe-west2, London) for storage and compute. Google group entities may access from the United States for support and maintenance. | UK Extension to the EU–US Data Privacy Framework, plus Google’s Cloud Data Processing Addendum. |
| Google Cloud EMEA Limited / Google LLC — Firebase Hosting | Serving our public website at marginchief.com. Handles only what is needed to deliver a page: IP address, browser and device information, the page requested and the referring site, recorded in request logs. No customer account data or uploaded documents are held here. | Global. Firebase Hosting is a content delivery network with edge locations worldwide and does not offer a choice of region or data residency. Uncached requests are served from a regional origin server, falling back to the United States. | UK Extension to the EU–US Data Privacy Framework, plus Google’s Cloud Data Processing Addendum. We rely on adequacy for Google LLC in the United States; the data involved is limited to request metadata for a public marketing site. |
| Google Cloud EMEA Limited / Google LLC — Document AI | Extracting text, tables and field values from documents that customers upload. Processes the content of customer documents. | United Kingdom (europe-west2, London). Processing is pinned to that region. | As above. Covered by Google’s Cloud Data Processing Addendum, under which customer data is not used to train Google’s models. |
| Google Cloud EMEA Limited / Google LLC — Vertex AI (Gemini) | Interpreting and classifying information extracted from customer documents. Processes the content of customer documents. | United Kingdom (europe-west2, London). Processing is pinned to that region. | As above. Covered by Google’s Cloud Data Processing Addendum. Vertex AI is an enterprise service under which customer data is not used to train Google’s models. |
| Supabase Pte Ltd | Managed PostgreSQL database, file storage, and realtime websocket connections to the application. | United Kingdom region for storage. Provider entity is in Singapore. | UK International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses. |
| WorkOS, Inc. | Authentication and session management. Processes account identifiers and sign-in events. | United States. | EU standard contractual clauses together with the UK Addendum, both incorporated into the WorkOS data processing addendum. |
| Honeycomb.io, Inc. | Application performance monitoring, traffic and error logging. Receives telemetry we send, which may incidentally contain personal data in error traces and request metadata. | European Union. We use Honeycomb’s EU region (eu1.honeycomb.io), not its United States region. | Transfer to the European Economic Area, which is covered by United Kingdom adequacy regulations. No additional safeguard is required. Honeycomb’s standard data processing agreement applies. |
| PT Kreasi Wacana Prima (trading as CloudRev Global) | Our development affiliate. Software development, maintenance, debugging and second and third line technical support. Remote access only; no data is stored in Indonesia. | Indonesia (access only). Data remains stored in the United Kingdom. | UK International Data Transfer Agreement, supported by a documented transfer risk assessment and the access controls described below. |
| Brevo (Sendinblue SAS) | Sending transactional email (account, billing and security messages) and marketing email, and managing customer and prospect records in its CRM. Processes name, business email address, employer, job title, message content and email engagement data. | European Union (France). | Transfer to the European Economic Area, which is covered by United Kingdom adequacy regulations. No additional safeguard is required. Brevo’s own data processing agreement applies. |
| PostHog, Inc. — EU Cloud | Website and product analytics across marginchief.com, app.marginchief.com and other subdomains. Records pages viewed, features used, device and browser information, approximate location derived from IP address, and a pseudonymous identifier. Session replay is not enabled. | European Union (PostHog EU Cloud, hosted in Frankfurt, Germany). Provider entity is in the United States. | Data is stored in the European Economic Area, which is covered by United Kingdom adequacy regulations. Where PostHog personnel in the United States access the data for support purposes, PostHog’s data processing agreement incorporates the EU standard contractual clauses and the UK Addendum. |
Who is not on this list
Paddle. Our products are sold through Paddle (Paddle.com Market Ltd, 30 Old Bailey, London EC4M 7AU), which is both our payment processor and our merchant of record. That second role is the important one: Paddle sells the subscription to you in its own right, appears on your card statement, issues your invoice, and decides how it handles the payment data it collects. It is therefore an independent controller, not our sub-processor, and its processing is governed by Paddle’s own privacy policy. We have not listed it in the table above because doing so would misdescribe the relationship — but we name it here so that nobody reviewing this list concludes that our payment provider is missing.
Professional advisers and authorities. Lawyers, accountants, insurers and regulators receive information in their own right or under legal compulsion, rather than processing on our instructions. They are covered in section 6 of our Privacy Policy.
Shopify and Xero. Connecting these is optional. If you choose to link your Shopify or Xero account so that MarginChief can retrieve your inventory and accounting data, that data flows between MarginChief and a system you control and have your own relationship with. We act on your instruction in making that connection; we do not engage Shopify or Xero to process data on our behalf. They are therefore not our sub-processors, and your own agreements with them govern their handling of your data.
Artificial intelligence processing
Two of the Google services above process the content of documents you upload: Document AI extracts text and field values, and Vertex AI interprets what it finds. This is how MarginChief reads an invoice.
Both run on Google Cloud’s enterprise platform under Google’s Cloud Data Processing Addendum. Under those terms your data is not used to train Google’s models, is not reviewed by people for product improvement, and is processed only to return a result to us. That matches the commitment in clause 5.2 of our Terms and Conditions and clause 4.4 of our Data Processing Agreement.
Specifically, we use Vertex AI, not Google AI Studio or the consumer Gemini API. That distinction matters: the consumer and free tiers operate on terms that permit Google to use submitted content to improve its products and to have it reviewed by people. We do not use those services for any customer data.
Website and product analytics
We use PostHog EU Cloud for analytics on our website and inside the application. We chose the European Union deployment, so analytics data is stored in Frankfurt rather than the United States.
PostHog sets cookies and uses local storage on your device, so it is not exempt from the consent rules. We ask for your consent before it loads, and it does not run unless you agree. Our Cookie Policy explains this and how to change your mind.
We do not use PostHog session replay, so we do not record what you do on screen.
Marketing, support and email tooling
We use Brevo for transactional email, marketing email and as our customer relationship management system. Transactional email covers messages you need in order to use the service, such as account confirmations, billing notices and security alerts. Marketing email is sent only where we have a lawful basis to do so, and every marketing message carries a one-click unsubscribe.
We do not use a separate third-party customer support tool. Support is handled by email.
Safeguards that apply to all sub-processors
Every sub-processor above is engaged under a written contract that imposes data protection obligations no less protective than those we owe you. In particular, each is required to:
- process personal data only on documented instructions, and only for the purpose stated above;
- keep personal data confidential, and ensure its personnel are under written confidentiality obligations;
- apply appropriate technical and organisational security measures;
- assist us with data subject requests, breach notification and impact assessments; and
- delete or return personal data at the end of the engagement.
Where a sub-processor is located in, or accesses data from, a country not covered by UK adequacy regulations, we put in place the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, supported by a transfer risk assessment.
Access from Indonesia. Our development affiliate accesses production data only to resolve specific issues. That access is granted to named individuals on a least-privilege basis, is time-limited and logged, and no data is downloaded or stored outside our United Kingdom systems. Encryption keys remain under our control, and redacted or synthetic data is used in preference to live data wherever the task allows.
How we notify you of changes
We will give you at least 30 days’ written notice before we engage a new sub-processor or change where customer data is stored.
You may object on reasonable data protection grounds within that period. If we cannot resolve your objection, you may terminate the affected subscription without penalty and receive a refund of fees prepaid for any period after termination. This is set out in clause 9.6 of our Terms and Conditions.
To receive these notifications, email info@marginchief.com with the subject line “Sub-processor updates” and the address you would like us to use. Account administrators are notified automatically.
Change history
| Date | Change | Effective |
|---|---|---|
| 6 August 2026 | Initial publication. | — |
CloudRev Intelligence Ltd, 71–75 Shelton Street, London WC2H 9JQ, United Kingdom. Registered in England and Wales, company number 17234811.
Questions about this list: info@marginchief.com