Sub-processors
Version 2026-10.1 · Effective 7 October 2026 · Anvilfy Ltd
In short
- These are the third parties Anvilfy Ltd uses to run EyeCaptain that may process personal data.
- Each one is bound by a written agreement with data protection terms. We update this page before adding or replacing a sub-processor.
This summary is for convenience and is not part of the sub-processors.
01Current sub-processors
| Provider | Purpose | Personal data | Location |
|---|---|---|---|
| Supabase Inc. | Database, authentication, file storage and server functions | All account, billing-status and analysis data | EU (Frankfurt, Germany) |
| Netlify Inc. | Website and web application hosting | IP address, request logs | USA / global CDN |
| Railway Corporation | Hosting of the page capture service | URLs submitted, captured page content and screenshots | USA (US West) |
| Browserless (Browserless Inc.) | Headless browser used to capture pages | URLs submitted, captured page content and screenshots | USA |
| Cloudflare Inc. (R2, Workers) | Storage and delivery of screenshots and report images, and the service that serves the tracking code and receives its measurements for Live heatmaps and A/B tests | Screenshots of analysed pages; visitor interaction figures without names, typed text, cookies or IP addresses, and a country code | Global |
| Firecrawl (Mendable Inc.) | Reading public pages of a website for context | URLs submitted and public page content | USA |
| OpenRouter Inc. | Backup routing to AI models, used only when direct access to Google Gemini is unavailable | Page content, screenshots and context needed for the analysis | USA |
| Google LLC / Google Ireland Ltd | AI models (Gemini API, called directly, including Google Search grounding for web research), PageSpeed Insights, Google sign-in, optional Google Analytics and Search Console connections, Google Analytics and Tag Manager on our website, calendar booking | Page content, URLs, account identifiers, website analytics data, booking details | USA / EU |
| Perplexity AI Inc. | Web research for content features, only when AI requests fall back to OpenRouter | Search queries; no account data | USA |
| Lovable Labs (AI gateway) | AI model access for internal tools, support chat and booking assistant | Messages and context you send to those features | EU / USA |
| PDFShift | Generating PDF exports of reports | Report content, including screenshots | EU |
| Stripe Payments Europe Ltd / Stripe Inc. | Payments, subscriptions and invoices | Name, email, billing address, payment method, transaction history | EU / USA |
| Brevo (Sendinblue SAS) | Transactional and marketing email | Name, email address, email content and engagement | EU (France) |
| Resend Inc. | Transactional email (backup provider) | Name, email address, email content | USA |
| Apollo.io | Business contact enrichment for leads and accounts | Email address, name, company | USA |
02Transfers outside the UK and EU
Where a sub-processor processes personal data outside the UK or the European Economic Area, we rely on an adequacy decision or regulation (including the EU-US Data Privacy Framework and its UK Extension where the provider is certified), or on the EU Standard Contractual Clauses with the UK International Data Transfer Addendum, together with supplementary measures where needed.
03Changes and objections
We will update this page at least 14 days before a new sub-processor starts processing customer personal data, except in an emergency. Business customers who have a Data Processing Addendum with us may object on reasonable data protection grounds by writing to hello@eyecaptain.io within that period, as set out in the Data Processing Addendum.