Sub-processors
Last updated: 8 June 2026
Gafferly is operated by SEO Engico Ltd. To provide the service we use the third parties below. Each is a “sub-processor” under UK GDPR Article 28: it processes personal data only on our documented instructions and under a written contract with appropriate security and confidentiality obligations. We keep this list up to date and, where you have a Data Processing Agreement with us, we will give reasonable notice of changes so you can object.
| Provider | Purpose | Location |
|---|---|---|
| Turso | Database hosting (your account, customer and job data) | USA / EU regions |
| Render | Application hosting and infrastructure | USA / EU regions |
| Cloudflare (R2) | File storage (photos, videos, documents) and CDN | Global edge network |
| Stripe | Subscription billing and card payment processing | USA / UK |
| Twilio | Sending and receiving SMS on your behalf | USA |
| Resend | Transactional email delivery | USA |
| Xero | Accounting sync (only if you connect Xero) | New Zealand / USA |
| Analytics and tag management (only with your cookie consent) | USA | |
| Meta | Advertising measurement (only with your cookie consent) | USA |
International transfers
Where a sub-processor is outside the UK, we rely on the UK GDPR transfer mechanisms set out in our Privacy Policy (UK adequacy regulations, or the UK International Data Transfer Agreement / the UK Addendum to the EU Standard Contractual Clauses), together with a transfer risk assessment.
Our Data Processing Agreement
If you are a business customer using Gafferly to manage your own customers’ data, you are the controller and we are your processor. Our Data Processing Agreement governs that relationship and forms part of your contract with us. For a signed copy or any questions, contact privacy@gafferly.com.