Legal
Subprocessors
Every third party that processes personal data for us, what it does, where the data goes and how it is protected.
Last updated .
A note on these dates. These policies were drafted before VOCABOTICS LTD was incorporated on 20 August 2026, and until 25 August 2026 they carried dates that predated the company they name as the contracting party and data controller. They were re-dated on that day, when the entity details on them were re-checked against the incorporation record. Nothing about the substance changed with the date; we are telling you because the old dates were not possible.
What a subprocessor is
When we do work for a client, or run vocabotics Console for a company, some personal data passes through services we rely on. Those services are our subprocessors. Each one works under a written contract that requires it to protect the data, and each gets only the data it needs. The table below lists every one we use for client work, for Console and for this website. Our data processing agreement (Annex 3) points to this page.
Where the data is
Console runs on Google Cloud in London, so the data you keep in it is stored in the UK. Some services are run from the US. For those, the transfer is covered by the UK Addendum to the EU Standard Contractual Clauses in the provider’s data processing terms. Where a provider is also certified under the UK extension to the EU-US Data Privacy Framework, that is an extra safeguard.
AI providers
Console’s AI staff use Anthropic’s Claude models, reached through OpenRouter, which we pin to those models. Data sent through these APIs is not used to train the models. A person checks anything AI staff prepare before it leaves the company. See the AI-use disclosure for more.
Not a subprocessor
Companies House is a public register. Console reads public company data from it, but it processes nothing for us, so it is not listed.
Changes
We update this page at least 14 days before we add or replace a subprocessor, and change the date above. If you have a data processing agreement with us, you may object on reasonable data-protection grounds in that time. Questions: privacy@vocabotics.com.
| Subprocessor | What they do for us | Data involved | Where | Transfer safeguard | When used |
|---|---|---|---|---|---|
| Google Cloud | Hosts vocabotics Console: the server, its encrypted storage, key management and nightly encrypted backups | Everything held in Console for you: documents, records, messages and account details | UK (London, europe-west2) | Stored in the UK. UK Addendum to the EU Standard Contractual Clauses, in the provider's data processing terms, for any support access from outside the UK | Always, for Console |
| Google (Gmail and Google Calendar) | Reads mail and calendars, and saves drafts, for the accounts you connect. Console never sends from Gmail itself | Email and calendar content of the connected account | Google's global data centres | UK Addendum to the EU Standard Contractual Clauses, in the provider's data processing terms | Only when you connect an account |
| OpenRouter | Routes Console's AI requests to the model provider. Pinned to Anthropic's Claude models; never an automatic router | The text of the task an AI staff member is working on | US | UK Addendum to the EU Standard Contractual Clauses, in the provider's data processing terms | Always, for AI work in Console |
| Anthropic | AI model provider (Claude), reached through OpenRouter or directly. API data is not used to train its models | The text of the task an AI staff member is working on | US | UK Addendum to the EU Standard Contractual Clauses, in the provider's data processing terms | Always, for AI work in Console and client work |
| Cloudflare | DNS, the secure tunnel to Console, and email routing for vocabotics.com addresses | IP addresses, request metadata, and email passing through our addresses | Global edge network; US | UK Addendum to the EU Standard Contractual Clauses, in the provider's data processing terms | Always |
| Resend (sending through Amazon SES) | Delivers the emails we send from Console | Recipient name and email address, message content | US | UK Addendum to the EU Standard Contractual Clauses, in the provider's data processing terms | When we send you email |
| Vercel | Hosts this website, vocabotics.com | IP addresses, request metadata, anything you type into a form on the site | US, with a global edge network | UK Addendum to the EU Standard Contractual Clauses, in the provider's data processing terms | Always, for the website |
| GitHub | Private source-code repositories | Source code, and project documents where a project is kept in our private repositories | US | UK Addendum to the EU Standard Contractual Clauses, in the provider's data processing terms | For software we build |
| Intuit QuickBooks | Bookkeeping. Console reads it and never writes to it | Customer names, contact details, invoices and payments | US | UK Addendum to the EU Standard Contractual Clauses, in the provider's data processing terms | Always, for our own books |
| Wise | Our business bank account. Console reads balances and payments through a read-only connection | Payer and payee names, amounts and payment references | UK and EEA | UK GDPR; Wise is also a controller in its own right for payments | Always, for payments |
| Cartesia | Voice: text to speech and phone calls | Call audio, transcripts and the text being spoken | US | UK Addendum to the EU Standard Contractual Clauses, in the provider's data processing terms | Only when a client opts in to voice work |
Next step
Questions about any of this? We’d rather you ask than wonder.