Subprocessor List
Last updated: July 2, 2026
What Are Subprocessors?
Subprocessors are third-party companies we use to deliver the Service. We share limited personal information with them as needed for them to perform their function on our behalf. They are bound by contract to handle information securely and only for our purposes.
We maintain Data Processing Agreements (DPAs) with each subprocessor.
Notification of Changes
We may add or change subprocessors as our infrastructure evolves. Material changes will be reflected on this page. If you have subscribed to subprocessor updates (in your account settings, when available), we will notify you by email at least 30 days before adding a new subprocessor.
Current Subprocessors
Infrastructure
| Subprocessor | Service | Location | Data Processed |
|---|---|---|---|
| Amazon Web Services, Inc. | Cloud hosting (or alternative — verify production stack) | United States | All operational data |
| Cloudflare, Inc. | CDN, DDoS protection, DNS | Global edge network | IP addresses, request metadata |
| Vercel Inc. | Frontend hosting (verify) | United States | Page requests |
Authentication and Identity
| Subprocessor | Service | Location | Data Processed |
|---|---|---|---|
| Auth0 / Clerk / Supabase Auth | Authentication (verify which) | United States | Email, password hashes, session data |
Payments
| Subprocessor | Service | Location | Data Processed |
|---|---|---|---|
| Stripe, Inc. | Payment processing | United States | Name, email, billing address, payment card |
Email Delivery
| Subprocessor | Service | Location | Data Processed |
|---|---|---|---|
| Twilio SendGrid | Transactional and marketing email | United States | Email address, name, email content |
AI Processing
| Subprocessor | Service | Location | Data Processed |
|---|---|---|---|
| Anthropic, PBC | Wren AI (Claude model) processing | United States | Chat messages, search context |
Analytics and Monitoring
| Subprocessor | Service | Location | Data Processed |
|---|---|---|---|
| Google LLC | Google Analytics | United States | Anonymized usage data |
| Mixpanel, Inc. | Product analytics | United States | Anonymized usage data |
| Sentry, Inc. | Error monitoring | United States | Error logs (may include user identifiers) |
Customer Support
| Subprocessor | Service | Location | Data Processed |
|---|---|---|---|
| [Intercom / Zendesk / HelpScout — verify] | Support ticketing | United States | Name, email, support messages |
Data Acquisition
| Subprocessor | Service | Location | Data Processed |
|---|---|---|---|
| Bright Data Ltd. | Proxy infrastructure for public listing data | Global | Public listing URLs (no user PII) |
Compliance
For each subprocessor, we:
- Conduct a privacy and security review before engagement
- Maintain a written Data Processing Agreement
- Verify they implement appropriate technical and organizational measures
- Periodically review their compliance posture
International Transfers
Many subprocessors are located in the United States. For data subject to UK or EU data protection law (limited in our case), we rely on:
- Standard Contractual Clauses (SCCs) approved by the UK ICO and European Commission
- Additional safeguards as appropriate (encryption, access controls, data minimization)
Removed Subprocessors
We will note here when subprocessors are removed.
— None at this time —
Sub-subprocessors
Some subprocessors use their own sub-vendors (e.g., AWS may host some of Stripe's infrastructure). We require subprocessors to maintain equivalent protections in their sub-vendor relationships.
Questions
Email: privacy@thenook.rent
Mail: Privacy Officer, Zentaro Systems Ltd, 167-169 Great Portland Street, 5th Floor, London, W1W 5PF, United Kingdom