Our providers
The companies that handle our clients’ data for us. Last changed 6 November 2026. This page is part of our data processing agreement, in the client terms.
Our sub-processors
When we process personal data for the organisations we work for, a few companies help us run the service. These are our sub-processors. Each one works only on our instructions, under a written contract that protects the data at least as well as our agreement does, and we stay responsible to our clients for each of them.
This page lists only the companies that handle our clients’ data. The companies we use for our own website, our own advertising, video calls and payments are listed in our privacy policy.
| Company | What it does for us | Where the data is | How a transfer out of the UK is protected |
|---|---|---|---|
| Supabase (Supabase Pte. Ltd, Singapore) | Our database, sign-in and file storage | Stored in Ireland | The UK Addendum to the EU standard contractual clauses, in Supabase's data processing agreement |
| Vercel (Vercel Inc., US) | Hosts our site, the platform and the pages we host; runs our server code | Server code in Dublin; pages served from a worldwide network; short-lived request logs | The UK-US data bridge (Vercel is on the UK Extension to the Data Privacy Framework), and the UK Addendum in Vercel's data processing agreement |
| Resend (Plus Five Five, Inc., US) | Sends our emails, including leads emailed to the addresses an organisation names. Keeps sent emails for 30 days | US | The UK-US data bridge |
| Cloudflare (Cloudflare, Inc., US) | Stores our nightly backup, encrypted before it leaves us so Cloudflare cannot read it; runs the spam check on forms we host | Worldwide | The UK-US data bridge |
| Anthropic (US processing) | The AI that reads an organisation's website to help write its pages and ads, and helps answer messages on the platform | US | The UK Addendum to the EU standard contractual clauses, in Anthropic's data processing agreement |
For a copy of the transfer terms in any of these contracts, email hello@itinexads.com and we will send it within a month.
Data that does not go through a sub-processor
Some recipients use data for their own purposes under their own terms. They are not our sub-processors:
- Taboola, the advertising network we buy campaigns from, receives the campaign settings, the organisation’s own ad pixels when it puts them on its ads, and, where the organisation has switched it on and the visitor’s choices allow, the network’s own reference for a click with word that it led to an enquiry. Taboola acts as a separate controller, under its own advertiser terms and privacy policy.
- Platforms and systems an organisation connects (for example Meta, Google, LinkedIn or TikTok pixels; Meta’s conversions route; its own CRM, webhook, Zapier or email addresses) receive what the organisation set up, under the organisation’s own agreements with them.
When this list changes
We give at least 30 days’ notice before we add or replace a sub-processor: we email the owners of every client account and update this page, with the date at the top. If a change is urgent, to keep the service secure or running, we may give less notice and will say why.
If you object
An organisation we work for may object to a new sub-processor on reasonable data protection grounds within the notice period, by emailing hello@itinexads.com with “Sub-processor” in the subject. We will discuss it in good faith. If we cannot resolve it, the organisation may stop using the affected feature or end the client terms without penalty, and we refund unused credit as the client terms provide.
Changes to this page
| Date | Change |
|---|---|
| 6 November 2026 | First published. |