Sub-processors
Last updated: 12 July 2026. We give at least 30 days notice of sub-processor changes — see below.
N90 Labs Limited (trading as Squigggle), company number 17006232, registered office 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, engages the following sub-processors in providing the Service. A sub-processor is a third-party vendor that processes personal data on our behalf.
| Sub-processor | Purpose | Data processed | Location | Transfer mechanism |
|---|---|---|---|---|
| Supabase, Inc. | Database, object storage, and authentication. All Customer Content (uploaded documents, signed documents, audit trails, account data, signer metadata) is stored here. Runs on underlying AWS infrastructure in the AWS London region (eu-west-2). | Account data, Content, authentication credentials | United Kingdom (London region) | UK IDTA / UK Addendum to EU SCCs |
| Vercel, Inc. | Application hosting, serverless compute, API request handling. Static assets served via a global edge network; Functions execute in the London (lhr1) region. Vercel's operational control plane, deployment logs, and billing operate from the United States. | Account data, Content (in transit during request processing), access logs | Compute: United Kingdom (lhr1). Control plane and operational logs: United States. | UK IDTA / UK Addendum to EU SCCs |
| Resend (Resend Inc.) | Transactional email delivery, including signer Email OTP verification codes, envelope invitations, reminders, and completion notifications. Email content is transient and retained only for operational logging windows. | Email addresses, email subject + body content, delivery metadata | United States | UK IDTA / UK Addendum to EU SCCs |
| Stripe, Inc. / Stripe Payments UK Ltd | Payment processing for Credit Bundles, Monthly Plan subscriptions, and Add-Ons. Squigggle does not receive or store card details; payments are handled entirely on Stripe-hosted pages. | Billing contact details, transaction amounts, Stripe customer ID | United States + Ireland (UK acquiring via Stripe Payments UK Ltd) | UK adequacy decision (EU) + UK IDTA (US). Stripe's own sub-processor list |
| Sentry (Functional Software, Inc.) | Application error monitoring and diagnostics. Captures exception stack traces, request metadata, and diagnostic context so we can detect and fix production faults. Configured with no session recording (Session Replay disabled) and no automatic capture of IP addresses, cookies, or request headers. Events are processed in Sentry's EU data region. | Technical error and diagnostic data (stack traces, request metadata); may incidentally include personal data contained within an error's context | European Union (Sentry EU data region, Germany) | Processed within the EU/EEA (UK adequacy regulations for the EEA); UK IDTA / UK Addendum to EU SCCs for any vendor access from the United States. |
| Google Cloud (Google Cloud EMEA Limited / Google LLC) | Hosts our self-managed Word (.docx) → PDF conversion service (LibreOffice via Gotenberg). Uploaded Word documents are sent to this service over TLS and converted to PDF; the conversion container runs network-egress-denied and does not persist documents. Runs on a Compute Engine instance in the London region (europe-west2). | Content (uploaded .docx documents, in transit and transiently in memory during conversion) | United Kingdom (Compute Engine, europe-west2 / London) | Processed in the United Kingdom; UK IDTA / UK Addendum to EU SCCs for any Google operational access from outside the UK. |
| PostHog, Inc. (PostHog EU Cloud) | Product analytics and session replay, used to understand how people use the Service and to diagnose usability problems. Processed entirely in PostHog's EU Cloud. Session recordings are captured with all text and all form inputs masked, so document content, signer names, and email addresses are never legible in a recording. Analytics and recording load only after you opt in via the cookie banner. | Usage and interaction events, masked session recordings, device and browser metadata, a persistent analytics identifier | European Union (PostHog EU Cloud) | Processed within the EU/EEA (UK adequacy regulations for the EEA); UK IDTA / UK Addendum to EU SCCs for any vendor operational access from the United States. |
| Google Workspace / Gmail (Google Cloud EMEA Limited / Google LLC) | Business email. Inbound support email (to support@squigggle.io) and our security@, privacy@, legal@ and accessibility@ inboxes are received and handled in Google Workspace (Gmail) before being triaged, and our team's replies are sent from it. | Email addresses, email subject + body content (which may include personal data you choose to include), delivery metadata | United States | UK IDTA / UK Addendum to EU SCCs |
| Linear Orbit, Inc. | Customer support ticket management. Inbound support emails (to support@squigggle.io) and in-app feedback are recorded as tickets in Linear so our team can track, triage, and respond to them. Correspondence content and your contact details are held there for the life of the ticket. | Support correspondence content, sender name and email address, ticket metadata | United States | UK IDTA / UK Addendum to EU SCCs. |
| Anthropic PBC | AI-assisted triage of customer support requests. When you contact support by email or through the in-app feedback form, the content of your message is sent to Anthropic's Claude API to classify the request and draft a suggested reply for our team to review. A human reviews and approves any substantive reply before it is sent, and Anthropic does not use data submitted through its API to train its models. | Support message content (which may include personal data you choose to include), subject line, sender name and email address | United States | UK IDTA / UK Addendum to EU SCCs. |
Supabase, Inc.
- Purpose
- Database, object storage, and authentication. All Customer Content (uploaded documents, signed documents, audit trails, account data, signer metadata) is stored here. Runs on underlying AWS infrastructure in the AWS London region (eu-west-2).
- Data processed
- Account data, Content, authentication credentials
- Location
- United Kingdom (London region)
- Transfer mechanism
- UK IDTA / UK Addendum to EU SCCs
Vercel, Inc.
- Purpose
- Application hosting, serverless compute, API request handling. Static assets served via a global edge network; Functions execute in the London (lhr1) region. Vercel's operational control plane, deployment logs, and billing operate from the United States.
- Data processed
- Account data, Content (in transit during request processing), access logs
- Location
- Compute: United Kingdom (lhr1). Control plane and operational logs: United States.
- Transfer mechanism
- UK IDTA / UK Addendum to EU SCCs
Resend (Resend Inc.)
- Purpose
- Transactional email delivery, including signer Email OTP verification codes, envelope invitations, reminders, and completion notifications. Email content is transient and retained only for operational logging windows.
- Data processed
- Email addresses, email subject + body content, delivery metadata
- Location
- United States
- Transfer mechanism
- UK IDTA / UK Addendum to EU SCCs
Stripe, Inc. / Stripe Payments UK Ltd
- Purpose
- Payment processing for Credit Bundles, Monthly Plan subscriptions, and Add-Ons. Squigggle does not receive or store card details; payments are handled entirely on Stripe-hosted pages.
- Data processed
- Billing contact details, transaction amounts, Stripe customer ID
- Location
- United States + Ireland (UK acquiring via Stripe Payments UK Ltd)
- Transfer mechanism
- UK adequacy decision (EU) + UK IDTA (US). Stripe's own sub-processor list
Sentry (Functional Software, Inc.)
- Purpose
- Application error monitoring and diagnostics. Captures exception stack traces, request metadata, and diagnostic context so we can detect and fix production faults. Configured with no session recording (Session Replay disabled) and no automatic capture of IP addresses, cookies, or request headers. Events are processed in Sentry's EU data region.
- Data processed
- Technical error and diagnostic data (stack traces, request metadata); may incidentally include personal data contained within an error's context
- Location
- European Union (Sentry EU data region, Germany)
- Transfer mechanism
- Processed within the EU/EEA (UK adequacy regulations for the EEA); UK IDTA / UK Addendum to EU SCCs for any vendor access from the United States.
Google Cloud (Google Cloud EMEA Limited / Google LLC)
- Purpose
- Hosts our self-managed Word (.docx) → PDF conversion service (LibreOffice via Gotenberg). Uploaded Word documents are sent to this service over TLS and converted to PDF; the conversion container runs network-egress-denied and does not persist documents. Runs on a Compute Engine instance in the London region (europe-west2).
- Data processed
- Content (uploaded .docx documents, in transit and transiently in memory during conversion)
- Location
- United Kingdom (Compute Engine, europe-west2 / London)
- Transfer mechanism
- Processed in the United Kingdom; UK IDTA / UK Addendum to EU SCCs for any Google operational access from outside the UK.
PostHog, Inc. (PostHog EU Cloud)
- Purpose
- Product analytics and session replay, used to understand how people use the Service and to diagnose usability problems. Processed entirely in PostHog's EU Cloud. Session recordings are captured with all text and all form inputs masked, so document content, signer names, and email addresses are never legible in a recording. Analytics and recording load only after you opt in via the cookie banner.
- Data processed
- Usage and interaction events, masked session recordings, device and browser metadata, a persistent analytics identifier
- Location
- European Union (PostHog EU Cloud)
- Transfer mechanism
- Processed within the EU/EEA (UK adequacy regulations for the EEA); UK IDTA / UK Addendum to EU SCCs for any vendor operational access from the United States.
Google Workspace / Gmail (Google Cloud EMEA Limited / Google LLC)
- Purpose
- Business email. Inbound support email (to support@squigggle.io) and our security@, privacy@, legal@ and accessibility@ inboxes are received and handled in Google Workspace (Gmail) before being triaged, and our team's replies are sent from it.
- Data processed
- Email addresses, email subject + body content (which may include personal data you choose to include), delivery metadata
- Location
- United States
- Transfer mechanism
- UK IDTA / UK Addendum to EU SCCs
Linear Orbit, Inc.
- Purpose
- Customer support ticket management. Inbound support emails (to support@squigggle.io) and in-app feedback are recorded as tickets in Linear so our team can track, triage, and respond to them. Correspondence content and your contact details are held there for the life of the ticket.
- Data processed
- Support correspondence content, sender name and email address, ticket metadata
- Location
- United States
- Transfer mechanism
- UK IDTA / UK Addendum to EU SCCs.
Anthropic PBC
- Purpose
- AI-assisted triage of customer support requests. When you contact support by email or through the in-app feedback form, the content of your message is sent to Anthropic's Claude API to classify the request and draft a suggested reply for our team to review. A human reviews and approves any substantive reply before it is sent, and Anthropic does not use data submitted through its API to train its models.
- Data processed
- Support message content (which may include personal data you choose to include), subject line, sender name and email address
- Location
- United States
- Transfer mechanism
- UK IDTA / UK Addendum to EU SCCs.
Not currently engaged (planned for later releases)
- Identity verification sub-processor (for the forthcoming AES with Identity Verification Signature Level) — will be added to this list with at least 30 days' notice before it is engaged.
- Qualified trust service provider (for the forthcoming QES Signature Level) — same.
- Uptime monitoring and SMS/WhatsApp delivery partners — will be added as engaged.
How we notify you of changes
When we engage a new sub-processor or replace an existing one, we will provide at least 30 days' advance notice by email (to the Account Admin) or by updating this page. If you object to the change, your sole remedy is to terminate the Agreement in accordance with clause 12 (Termination) of the Terms of Service.