1. About this page
We use a small number of third-party providers to run ivee. Each one that handles personal data on our behalf is listed here, along with what it does, what data it touches, and where it is located.
We publish this because transparency about your data supply chain is the right default, and because our business customers' data processing agreements require it.
ivee is a trading name of IVY HQ LIMITED, company number 15104292, registered office Arquen House, 4-6 Spicer Street, St. Albans, England, AL3 4PQ. Contact us at hello@ivee.jobs.
Read this alongside our Privacy Policy.
2. What "sub-processor" means here
Where we act as a controller - for billing, our own website visitors, marketing contacts, CRM records, programme participants and app users on the Free and Paid Personal tiers - these providers are our processors.
Where we act as a processor - for an organisation that buys seats on the ivee app Teams tier, or for a consulting client - these providers are our sub-processors for that organisation's data. On the Teams tier, the organisation is the controller of all personal data we process to provide the app to it, and we use that data only to provide and improve the service for that organisation, never across customers. For Teams organisations, the only providers that act as sub-processors of the organisation's data are those marked "Applies to: app account data": AWS (including Amazon Bedrock), SendGrid and PostHog. Stripe, Xero, ActiveCampaign, Attio and Google Analytics are our own processors, used for data we control. Stripe is also an independent controller for its own purposes (see 3.2).
Either way, each one is bound by a written contract containing the terms required by Article 28 of the UK GDPR. They may only use the data to provide their service to us, they may not use it for their own purposes, and they must keep it secure. The one exception to the second point is Stripe, as set out above.
3. Our current providers
Each entry below notes Applies to: whether that provider touches app account data, general website data, or both - so it is clear at a glance which parts of ivee a provider is involved in.
3.1 Infrastructure and hosting
Amazon Web Services EMEA SARL - hosting, database infrastructure and backups for the ivee app and website, including our RDS databases. Data: all data ivee stores in the course of running the service. Location: United Kingdom (AWS eu-west-2, London). Terms: aws.amazon.com/privacy. Applies to: app account data and website data.
3.2 Core service delivery
Amazon Web Services EMEA SARL, through Amazon Bedrock - runs Anthropic's Claude models to produce prompt rewrites and scores. Data: the draft prompt text, including chat history where applicable, and the app name only. Bedrock does not receive the website domain, the account or the email address, and does not store what it processes. Location: sent to AWS London (eu-west-2) and processed in AWS EU regions, at present mostly Ireland and Sweden. Terms: aws.amazon.com/service-terms and aws.amazon.com/compliance/gdpr-center; Anthropic's model terms on Bedrock at aws.amazon.com/legal/bedrock/third-party-models. Applies to: app account data.
Twilio Ireland Limited (with Twilio Inc.), through its SendGrid service - transactional email for the ivee app, including magic-link sign-in emails. Data: email address. Location: United States and EU. Terms: twilio.com/en-us/legal/data-protection-addendum. Applies to: app account data (email address).
Stripe Payments Europe, Limited - payments, invoicing and subscriptions for app subscriptions and smaller contracts. Stripe acts as our processor to provide its payment services, and as an independent controller for its own purposes: fraud prevention, risk and loss prevention, legal and regulatory compliance (including anti-money laundering and know-your-customer checks), and improving its own products. Data: name, email, billing address, transaction data, partial card details. Location: transferred to Stripe, LLC in the US. Terms: stripe.com/privacy and stripe.com/gb/legal/dpa. Applies to: paying customers (billing).
Xero (UK) Limited - invoicing on larger contracts, used instead of Stripe. Data: name, email, billing address, invoice and transaction data. Location: United States (Xero hosts on AWS in the US). Terms: xero.com/uk/legal/privacy and xero.com/uk/legal/terms/data-processing. Applies to: paying customers on larger invoiced contracts.
Note on Amazon Bedrock and Anthropic. Anthropic builds the models but is not one of our providers and never receives prompt data: on Bedrock its models run inside AWS accounts that Anthropic cannot access. Zero data retention. For the models we use, Amazon Bedrock does not store prompts or the responses it produces, does not use them to train any model and does not share them with Anthropic. Bedrock's own request logging is switched off in our account. The only copy of a prompt is the one we keep in prompt history, under the retention rules in this document.
Where it is processed. We send every request to AWS's London region. To handle demand, AWS may process a request in another of its EU regions (at present mostly Ireland and Sweden), and never outside the EU. Data travels encrypted over AWS's private network and is not stored in the region that processes it. The EU is covered by UK adequacy regulations, so no further transfer safeguard is needed. Our contract is with Amazon Web Services EMEA SARL, under the AWS Customer Agreement and the AWS GDPR Data Processing Addendum.
3.3 Communications and customer management
ActiveCampaign, LLC - marketing email and audience segmentation. Data: name, email, job title, employer, engagement data, segmentation attributes. Location: United States. Terms: activecampaign.com/legal/privacy-policy. Applies to: website visitors and marketing contacts.
Attio Ltd - customer relationship management, records of enquiries, clients and participants. Data: name, email, job title, employer, correspondence, enquiry context. Location: EU, United States. Terms: attio.com/legal/privacy. Applies to: website enquiries, programme and consulting clients.
3.4 Analytics
PostHog, Inc. - product analytics in the ivee app, and website analytics and session recording. In the app, PostHog receives usage events only, such as clicks, feature use and timings. There is no session recording in the app and PostHog receives no prompt text. Data: usage data, device data, cookie identifiers, and session recordings on the website only. Location: EU (Frankfurt), with some processing in the US. Terms: posthog.com/privacy. Applies to: app account data (in-app usage events) and website visitors.
Google Ireland Ltd / Google LLC - website analytics (Google Analytics 4). Data: usage data, device data, cookie identifiers, anonymised IP address. Location: United States. Terms: policies.google.com/privacy. Applies to: website visitors only.
On our website, analytics providers only receive data where you have consented through our cookie banner. See our Cookie Policy. In the ivee app, PostHog receives usage events on the basis of our legitimate interests in running, fixing and improving the app. You can object to this by emailing hello@ivee.jobs.
4. International transfers
Some of our providers process data outside the UK, principally in the United States and the EU. Where that happens we rely on one or more of the following safeguards, as Chapter V of the UK GDPR requires:
UK adequacy regulations, where they cover the destination - this includes the EU and EEA;
The UK International Data Transfer Agreement, or the UK Addendum to the European Commission's Standard Contractual Clauses;
The UK Extension to the EU-US Data Privacy Framework, where the provider is certified;
Binding Corporate Rules approved for the provider's group of companies.
AWS holds stored data in the UK. Amazon Bedrock processes prompts in AWS EU regions without storing them, which UK adequacy regulations cover. Attio is UK-based, and its own onward transfers use the UK International Data Transfer Agreement, the UK Addendum and the EU Standard Contractual Clauses. The safeguards for our other providers are:
SendGrid (Twilio) - the UK Extension to the EU-US Data Privacy Framework, Twilio's Binding Corporate Rules and the UK International Data Transfer Agreement.
PostHog - the UK Extension to the EU-US Data Privacy Framework and the UK Addendum to the Standard Contractual Clauses.
Stripe - the UK Extension to the EU-US Data Privacy Framework, then the UK International Data Transfer Addendum.
Xero - the EU Standard Contractual Clauses with the UK Addendum.
ActiveCampaign - the UK Extension to the EU-US Data Privacy Framework, or the Standard Contractual Clauses with the UK Addendum.
Google Analytics - the UK Extension to the EU-US Data Privacy Framework (Google LLC is certified) and the Standard Contractual Clauses with the UK Addendum.
We complete a transfer risk assessment for each transfer and keep it on file. You may request a copy of the safeguards applying to a specific provider by emailing hello@ivee.jobs.
5. Providers we do not use
For the avoidance of doubt, we do not use:
advertising networks, ad exchanges or demand-side platforms;
retargeting or remarketing pixels;
social media tracking pixels;
data brokers, list vendors or enrichment services that acquire personal data without the person's knowledge;
any provider that trains AI models on our users' data.
6. Changes to this list
We will update this page whenever we add, remove or replace a provider.
If you have a data processing agreement with us, you authorise us to use the providers listed at ivee.jobs/legal/subprocessors that process app account data. We'll give at least 30 days' written notice before we add or replace a provider that will handle your data. You may object on reasonable grounds within that period by emailing hello@ivee.jobs. We'll work with you to resolve it, including not using that provider for your account where practical. If we can't, either of us may end the affected services without penalty.
Recent changes. 20 October 2026: Anthropic Ireland, Limited removed. Since 7 October 2026 the prompt improver has used Anthropic's Claude models through Amazon Bedrock, run by AWS, which was already on this list. Anthropic no longer receives any prompt data, and prompts are no longer stored by the AI provider or processed outside the EU.
To be notified of changes to this page, email hello@ivee.jobs with "Subprocessor notifications" in the subject line and we will add you to the list.
7. Contact
Email: hello@ivee.jobs
Data Protection Officer: Lex Dinamica Ltd, Michelin House, 81 Fulham Road, London, SW3 6RD - contact via hello@ivee.jobs marked "DPO"
