1. About this page
We use a small number of third-party providers to run ivee. Each one that handles personal data on our behalf is listed here, along with what it does, what data it touches, and where it is located.
We publish this because transparency about your data supply chain is the right default, and because our business customers' data processing agreements require it.
ivee is a trading name of IVY HQ LIMITED, company number 15104292, registered office Arquen House, 4-6 Spicer Street, St. Albans, England, AL3 4PQ. Contact us at hello@ivee.jobs.
Read this alongside our Privacy Policy.
2. What "sub-processor" means here
Where we act as a controller - for billing, our own website visitors, marketing contacts, CRM records, programme participants and app users on the Free and Paid Personal tiers - these providers are our processors.
Where we act as a processor - for an organisation that buys seats on the ivee app Teams tier, or for a consulting client - these providers are our sub-processors for that organisation's data. On the Teams tier, the organisation is the controller of all personal data we process to provide the app to it, and we use that data only to provide and improve the service for that organisation, never across customers. For Teams organisations, the only providers that act as sub-processors of the organisation's data are those marked "Applies to: app account data": AWS, Anthropic, SendGrid and PostHog. Stripe, Xero, ActiveCampaign, Attio and Google Analytics are our own processors, used for data we control. Stripe is also an independent controller for its own purposes (see 3.2).
Either way, each one is bound by a written contract containing the terms required by Article 28 of the UK GDPR. They may only use the data to provide their service to us, they may not use it for their own purposes, and they must keep it secure. The one exception to the second point is Stripe, as set out above.
3. Our current providers
Each entry below notes Applies to: whether that provider touches app account data, general website data, or both - so it is clear at a glance which parts of ivee a provider is involved in.
3.1 Infrastructure and hosting
Amazon Web Services EMEA SARL - hosting, database infrastructure and backups for the ivee app and website, including our RDS databases. Data: all data ivee stores in the course of running the service. Location: United Kingdom (AWS eu-west-2, London). Terms: aws.amazon.com/privacy. Applies to: app account data and website data.
3.2 Core service delivery
Anthropic Ireland, Limited (with Anthropic PBC) - provides the AI model that produces prompt rewrites and scores. Data: the draft prompt text, including chat history where applicable, and the app name only. Anthropic does not receive the website domain, the account or the email address. Location: stored in the US; processing may run in the US, Europe, Asia or Australia. Terms: anthropic.com/legal/commercial-terms and anthropic.com/legal/data-processing-addendum. Applies to: app account data.
Twilio Ireland Limited (with Twilio Inc.), through its SendGrid service - transactional email for the ivee app, including magic-link sign-in emails. Data: email address. Location: United States and EU. Terms: twilio.com/en-us/legal/data-protection-addendum. Applies to: app account data (email address).
Stripe Payments Europe, Limited - payments, invoicing and subscriptions for app subscriptions and smaller contracts. Stripe acts as our processor to provide its payment services, and as an independent controller for its own purposes: fraud prevention, risk and loss prevention, legal and regulatory compliance (including anti-money laundering and know-your-customer checks), and improving its own products. Data: name, email, billing address, transaction data, partial card details. Location: transferred to Stripe, LLC in the US. Terms: stripe.com/privacy and stripe.com/gb/legal/dpa. Applies to: paying customers (billing).
Xero (UK) Limited - invoicing on larger contracts, used instead of Stripe. Data: name, email, billing address, invoice and transaction data. Location: United States (Xero hosts on AWS in the US). Terms: xero.com/uk/legal/privacy and xero.com/uk/legal/terms/data-processing. Applies to: paying customers on larger invoiced contracts.
Note on Anthropic: We use Anthropic's standard commercial API. We have no bespoke agreement with Anthropic and no zero data retention arrangement. Anthropic's standard terms don't allow it to train its models on the prompts we send. Anthropic automatically deletes those prompts and its responses within 30 days. The exceptions are content its safety systems flag under its Usage Policy (kept for up to 2 years, with safety scores kept for up to 7 years) and data it must keep by law.
Anthropic stores data in the United States. By default, the processing that produces your rewrite may run in the US, Europe, Asia or Australia. Anthropic doesn't offer UK or EU storage. Our contract is with Anthropic Ireland, Limited. Where personal data leaves the UK, it's protected by the EU Standard Contractual Clauses and the UK Information Commissioner's International Data Transfer Addendum, both part of Anthropic's standard Data Processing Addendum.
3.3 Communications and customer management
ActiveCampaign, LLC - marketing email and audience segmentation. Data: name, email, job title, employer, engagement data, segmentation attributes. Location: United States. Terms: activecampaign.com/legal/privacy-policy. Applies to: website visitors and marketing contacts.
Attio Ltd - customer relationship management, records of enquiries, clients and participants. Data: name, email, job title, employer, correspondence, enquiry context. Location: EU, United States. Terms: attio.com/legal/privacy. Applies to: website enquiries, programme and consulting clients.
3.4 Analytics
PostHog, Inc. - product analytics in the ivee app, and website analytics and session recording. In the app, PostHog receives usage events only, such as clicks, feature use and timings. There is no session recording in the app and PostHog receives no prompt text. Data: usage data, device data, cookie identifiers, and session recordings on the website only. Location: EU (Frankfurt), with some processing in the US. Terms: posthog.com/privacy. Applies to: app account data (in-app usage events) and website visitors.
Google Ireland Ltd / Google LLC - website analytics (Google Analytics 4). Data: usage data, device data, cookie identifiers, anonymised IP address. Location: United States. Terms: policies.google.com/privacy. Applies to: website visitors only.
On our website, analytics providers only receive data where you have consented through our cookie banner. See our Cookie Policy. In the ivee app, PostHog receives usage events on the basis of our legitimate interests in running, fixing and improving the app. You can object to this by emailing hello@ivee.jobs.
4. International transfers
Some of our providers process data outside the UK, principally in the United States and the EU. Anthropic's processing may also run in Asia or Australia. Where that happens we rely on one or more of the following safeguards, as Chapter V of the UK GDPR requires:
UK adequacy regulations, where they cover the destination - this includes the EU and EEA;
The UK International Data Transfer Agreement, or the UK Addendum to the European Commission's Standard Contractual Clauses;
The UK Extension to the EU-US Data Privacy Framework, where the provider is certified;
Binding Corporate Rules approved for the provider's group of companies.
AWS holds data in the UK, so no international transfer applies to it. Attio is UK-based, and its own onward transfers use the UK International Data Transfer Agreement, the UK Addendum and the EU Standard Contractual Clauses. The safeguards for our other providers are:
Anthropic - the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, both part of Anthropic's standard Data Processing Addendum.
SendGrid (Twilio) - the UK Extension to the EU-US Data Privacy Framework, Twilio's Binding Corporate Rules and the UK International Data Transfer Agreement.
PostHog - the UK Extension to the EU-US Data Privacy Framework and the UK Addendum to the Standard Contractual Clauses.
Stripe - the UK Extension to the EU-US Data Privacy Framework, then the UK International Data Transfer Addendum.
Xero - the EU Standard Contractual Clauses with the UK Addendum.
ActiveCampaign - the UK Extension to the EU-US Data Privacy Framework, or the Standard Contractual Clauses with the UK Addendum.
Google Analytics - the UK Extension to the EU-US Data Privacy Framework (Google LLC is certified) and the Standard Contractual Clauses with the UK Addendum.
We complete a transfer risk assessment for each transfer and keep it on file. You may request a copy of the safeguards applying to a specific provider by emailing hello@ivee.jobs.
5. Providers we do not use
For the avoidance of doubt, we do not use:
advertising networks, ad exchanges or demand-side platforms;
retargeting or remarketing pixels;
social media tracking pixels;
data brokers, list vendors or enrichment services that acquire personal data without the person's knowledge;
any provider that trains AI models on our users' data.
6. Changes to this list
We will update this page whenever we add, remove or replace a provider.
If you have a data processing agreement with us, you authorise us to use the providers listed at ivee.jobs/legal/subprocessors that process app account data. We'll give at least 30 days' written notice before we add or replace a provider that will handle your data. You may object on reasonable grounds within that period by emailing hello@ivee.jobs. We'll work with you to resolve it, including not using that provider for your account where practical. If we can't, either of us may end the affected services without penalty.
To be notified of changes to this page, email hello@ivee.jobs with "Subprocessor notifications" in the subject line and we will add you to the list.
7. Contact
Email: hello@ivee.jobs
Data Protection Officer: Lex Dinamica Ltd, Michelin House, 81 Fulham Road, London, SW3 6RD - contact via hello@ivee.jobs marked "DPO"
