Legal
Sub-processors
Version 2026-10-01
These are the service providers TOURLI LTD uses to process personal data, where they process it, and the safeguard we rely on when data leaves the UK or EU. See our privacy notice for how we use your data. Questions: privacy@tourli.com.
| Provider | Purpose | Processing region | Transfer safeguard | DPA |
|---|---|---|---|---|
| Amazon Web Services (SES, Route 53) | Marketing email delivery; DNS | EU (Ireland, eu-west-1); Route 53 global | SCCs + UK Addendum via AWS DPA; EU–US DPF / UK–US Data Bridge | Automatic with AWS terms (aws.amazon.com/compliance/gdpr-center) |
| Resend | Transactional email (confirmations, receipts) | EU (Ireland, eu-west-1) | SCCs + UK Addendum via Resend DPA | Automatic with terms (resend.com/legal/dpa) |
| Supabase | Database, authentication, storage | UK (London, eu-west-2) | SCCs + UK Addendum via Supabase DPA | Automatic with terms (supabase.com/legal/dpa) |
| Railway | Application hosting | EU | SCCs + UK Addendum via Railway DPA | Provider terms; DPA available on request (railway.com/legal/dpa) |
| Trigger.dev | Background jobs | EU | SCCs + UK Addendum via Trigger.dev DPA | Provider terms; DPA available on request |
| Sentry | Error monitoring | US | SCCs + UK Addendum via Sentry DPA; EU–US DPF / UK–US Data Bridge | Provider terms; DPA available in organisation settings |
| PostHog | Product analytics, session recording | US | SCCs + UK Addendum via PostHog DPA; EU–US DPF / UK–US Data Bridge | Provider terms; DPA available in app (posthog.com/dpa) |
| Cloudflare | Website hosting, bot protection (including Turnstile) | Global | SCCs + UK Addendum via Cloudflare DPA; EU–US DPF / UK–US Data Bridge | Automatic (cloudflare.com/cloudflare-customer-dpa) |
| Stripe (incl. Connect) | Payments, creator payouts | US / global | SCCs + UK Addendum via Stripe DPA; EU–US DPF / UK–US Data Bridge | Automatic (stripe.com/legal/dpa) |
| RevenueCat | In-app subscriptions (iOS) | US | SCCs + UK Addendum via RevenueCat DPA; EU–US DPF | Automatic with terms |
| Apple | App Store, sign-in, push | US / global | SCCs + UK Addendum; EU–US DPF / UK–US Data Bridge | Automatic with developer terms |
| Sign-in, Gemini (place information) | US / global | SCCs + UK Addendum via Cloud Data Processing Addendum; EU–US DPF / UK–US Data Bridge | Automatic | |
| OpenAI | AI-assisted features | US | SCCs + UK Addendum via OpenAI DPA; EU–US DPF | Provider terms; DPA available on request |
| Mapbox | Maps | US | SCCs + UK Addendum via Mapbox DPA | Provider terms; DPA available on request |
| Anthropic | AI-assisted features | US | SCCs + UK Addendum, via Anthropic's data processing terms | Provider terms |
| Meta (Meta Pixel) | Advertising measurement, only with your cookie consent | US / global | SCCs + UK Addendum via the provider's data processing terms; EU–US Data Privacy Framework | Provider terms |
| TikTok (TikTok Pixel) | Advertising measurement, only with your cookie consent | US / global | SCCs + UK Addendum via the provider's data processing terms | Provider terms |