Sub-processors
Every third party that touches customer data, what it does, what it sees, and where it is.
This is the complete list. It is short on purpose: each name on it is a place your messages can reach, so we add one only when the product cannot work without it. If you want to be told when this page changes, email hello@flipsyd.app and we will add you to the notice list.
Current sub-processors
| Provider | Purpose | Data it sees | Location | Transfer safeguard |
|---|---|---|---|---|
| Amazon Web Services (AWS) | All hosting: compute, database, queues, object storage, secret storage, logging, and sending and receiving email on your Flipsyd address. | Account record, encrypted access tokens, message content in transit and while briefly cached, inbound email, operational logs (never message bodies or tokens). | London, United Kingdom (eu-west-2) | Data stays in the UK region. A small set of global-only services (TLS certificates, cost anomaly detection) runs in us-east-1 and holds no customer data. |
| Anthropic | Summarising a long message into something that fits a text, on the Full plan only. | The message text being summarised (after secret redaction) and the sender's display name. No phone number, no account identifier, no billing data. | United States | Standard contractual clauses with the UK International Data Transfer Addendum. |
| Twilio | Sending and receiving SMS, running the inbound voice line, and sending the one-time code that verifies your phone number at signup. | Your mobile number, the Flipsyd number in use, and the text of each message sent to or from you. | United States and Ireland | Standard contractual clauses with the UK International Data Transfer Addendum. |
| Telnyx | Sending and receiving SMS and inbound voice calls on the UK and US number lanes. | Your mobile number, the Flipsyd number in use, and the text of each message sent to or from you. | United States and Ireland | Standard contractual clauses with the UK International Data Transfer Addendum. |
| Stripe | Taking subscription payments, holding your card details, and issuing refunds. | Your email address if you give one at checkout, card details (held by Stripe, never by us), and your subscription and payment history. | Ireland and United States | Stripe Payments Europe acts as the contracting entity; onward transfers are covered by standard contractual clauses with the UK Addendum. |
What is not on the list
There is no analytics provider, no advertising or attribution network, no session-replay tool, no customer-data platform and no third-party error tracker. The Flipsyd website loads no third-party scripts at all. If that changes, this page changes first.
Services you connect yourself
These are your own accounts rather than our sub-processors — we act on them with the permissions you grant, and their own terms and privacy policies govern them.
- Slack — Reads the messages you can already see and posts your replies under your own account.
- Email — Mail sent to the Flipsyd address we generate for you arrives over standard SMTP.
Changing the list
Before we add a sub-processor we sign a data processing agreement with it, check where it processes data and under what transfer mechanism, and satisfy ourselves it offers appropriate technical and organisational measures. We will publish the change here, and give notice to anyone on the notice list, before the new provider starts handling customer data. If you object to a new sub-processor on reasonable data-protection grounds you can cancel and we will refund the unused part of the month, as set out in the refunds policy.
How we handle your data overall — including retention and your rights — is in the privacy notice.