1. What a subprocessor is

A subprocessor is a company that handles personal data on our behalf so that we can deliver sparx to you. Our Data Processing Addendum requires us to keep this list current, to hold each company to data-protection terms no weaker than our own, and to give you notice before we add one, so you have the chance to object.

Companies that never touch your data are not subprocessors and are deliberately left off this page. Our accounting software and our source-control host are vendors, not subprocessors, and listing them would only make the real list harder to read.

2. The companies we use

These run on our accounts, on credentials we hold. They are our subprocessors, and we are responsible for them.

Google Cloud Platform: all hosting, the database, uploaded files, background processing, and our secret storage. Every record and every file in your account lives here. This is the primary subprocessor; the others are narrow by comparison.
Cloudflare: the DNS, content delivery network, and encrypted connections in front of your sites. Handles traffic in transit and caches your public pages.
Mailgun: delivery of the email you send through sparx, and of our own account email. Handles recipient email addresses and the contents of the messages.
Twilio: delivery of text messages, where you have turned on SMS notifications such as appointment reminders. Handles recipient phone numbers and message contents.
Stripe: billing for your sparx subscription, and payouts to marketplace sellers and referral partners. Handles payer names, billing contacts, and payment metadata. Card numbers go to Stripe directly and never reach our systems.
GoDaddy: domain registration and DNS, when you buy a domain name through sparx. Handles the registrant contact details that domain-name rules require to be recorded against a domain.
PostHog: product analytics on our marketing site and in the sparx dashboard, so we can see which features get used. Handles usage events for your staff users only. It is never loaded on your own sites, so it never sees your customers, and it only runs at all for visitors who accept analytics cookies.

3. Services you connect yourself

sparx also talks to services that you choose and connect with your own account and your own credentials: shipping carriers and rate providers, tax-calculation services, payment gateways other than Stripe, AI providers, and social media platforms.

These are a different arrangement. When sparx sends data to one of them, it does so at your instruction, on the relationship you already have with that company, under the terms youagreed to. They are not processing data on our behalf, so they are not our subprocessors, but you should account for them in your own privacy notice, because from your customers’ point of view they are still a place their data goes.

4. Two things we do not use

We do not run AI on our own account. sparx holds no AI provider key of its own. Every AI feature (the site assistant, drafting help, the live-chat replies) runs on a key yousupply, or through an AI tool you connect yourself. That means your data is never sent to an AI provider on our credential, and nothing in your account is used to train anyone’s model, ours included.

Our search index is not a vendor. Product and content search runs on software we host ourselves inside our own Google Cloud environment. Your data does not leave it, so there is no separate search company on this list.

5. Where the data sits

Our infrastructure runs in Google Cloud’s central United States region. If your business or your customers are outside the United States, that is a cross-border transfer, and we rely on the safeguards described in the Data Processing Addendum to make it lawful.

6. Changes & objections

When we add a subprocessor, we update this page and change the version and date at the top, and we notify account owners before the change takes effect. If you have a reasonable objection to a new subprocessor, email [email protected] and we will work with you on it: the process is set out in section 6 of the DPA.