Sub-processors
Last updated: 23 October 2026
Gafferly is operated by Gafferly Group Ltd. To provide the service we use the third parties below. Each is a “sub-processor” under UK GDPR Article 28: it processes personal data only on our documented instructions and under a written contract with appropriate security and confidentiality obligations. We keep this list up to date and, where you have a Data Processing Agreement with us, we will give reasonable notice of changes so you can object.
| Provider | Purpose | Location |
|---|---|---|
| Turso | Database hosting (your account, customer and job data) | USA / EU regions |
| Render | Application hosting and infrastructure | USA / EU regions |
| Cloudflare (R2) | File storage (photos, videos, documents) and CDN | Global edge network |
| Stripe | Subscription billing for Gafferly plans | USA / UK |
| Twilio | SMS, WhatsApp messages, phone numbers and calls on your behalf, including UK number registration (business details, and identity documents for sole traders, sent directly to Twilio) | USA |
| Resend | Transactional email delivery | USA |
| Xero | Accounting sync (only if you connect Xero) | New Zealand / USA |
| Microsoft | Mailbox sync via Microsoft Graph (only if you connect Outlook) | EU / USA |
| Google (Gmail) | Sending your replies and bringing in your customers' emails via the Gmail API (only if you connect Gmail). Covered by the Google API Services User Data Policy, including the Limited Use requirements. | USA |
| Meta (WhatsApp) | Delivering your WhatsApp messages (only if you turn on WhatsApp), under your own WhatsApp Business terms with Meta | USA |
| Anthropic | AI drafting features. Job and customer text you choose to run through an AI action, and recent messages when a WhatsApp reply is drafted, is sent to Anthropic to generate the draft. Not used to train their models. | USA |
| Deepgram | Speech to text and the AI phone assistant (notes, job wrap-ups, checklists, quotes, answered calls). Audio is processed in the EU, deleted from Gafferly after 30 days, and opted out of Deepgram model improvement. | EU |
| Apple | Push notifications to the iOS app (device token and the notification text) | USA |
| Analytics and tag management (only with your cookie consent) | USA | |
| Meta | Advertising measurement (only with your cookie consent) | USA |
Card payments you take from your own customers run on your own Stripe account, under your own agreement with Stripe, so for those Stripe is your provider, not our sub-processor. See section 14 of our Privacy Policy, which covers the Gafferly app for Stripe.
International transfers
Where a sub-processor is outside the UK, we rely on the UK GDPR transfer mechanisms set out in our Privacy Policy (UK adequacy regulations, or the UK International Data Transfer Agreement / the UK Addendum to the EU Standard Contractual Clauses), together with a transfer risk assessment.
Our Data Processing Agreement
If you are a business customer using Gafferly to manage your own customers’ data, you are the controller and we are your processor. Our Data Processing Agreement governs that relationship and forms part of your contract with us. For a signed copy or any questions, contact privacy@gafferly.com.