Sub-processors
This page lists the third-party service providers (“sub-processors”) we rely on to operate GotBack. They process personal data on our behalf under data-processing agreements that incorporate the safeguards required by the UK GDPR and the EU GDPR. We will update this list when we add, remove, or replace a provider.
Current sub-processors
| Provider | Purpose | Personal data | Processing location |
|---|---|---|---|
| Logto | Authentication, account management | Name, email address, profile picture, session metadata | European Economic Area |
| Stripe (Stripe Payments UK Ltd and affiliates) | Subscription billing, reward charges and refunds, finder payouts via Stripe Connect, KYC and anti-fraud | Card metadata (last four, brand, expiry), billing address, customer ID, payout identity-verification details, transaction history | United Kingdom, European Economic Area, United States |
| Resend | Transactional email delivery | Email address, name, email content, delivery metadata | European Economic Area, United States |
| PostHog | Product analytics and session replay (opt-in) | Pseudonymous distinct ID, interaction events, masked session-replay frames, IP address (truncated) | European Economic Area |
| Fireworks AI | AI-assisted item-description generation from photos and text | Photo and text you submit for a post (no training on inputs per contract) | United States |
| Cloudflare | DNS, TLS, content delivery, DDoS and bot protection | IP address, request metadata, security signals | Global edge network (closest point of presence to the user) |
| Hostinger | Virtual private server hosting — runs our application, database, object storage (photos), cache, and self-hosted vector database | All application data, including everything listed in the Privacy Policy, stored on encrypted disks | United Kingdom — Manchester |
How we evaluate providers
Before adding a sub-processor we assess whether they can meet our security and data-protection requirements, whether their location is compatible with applicable transfer rules, and whether their terms allow our users’ data to be processed only on our instructions and not used to train their general models.
Changes
We will update this page when we add, remove, or replace a sub-processor. For material changes that affect categories of data sent to a new provider, we will also notify users through the service or by email.
Contact
Questions about our sub-processors: support@gotback.world.
