Sub-processors
Last updated: 21 September 2026.
What this page is
These are the third parties we use to run Leadistry that come into contact with personal data. Each one processes it on our instructions, under a written contract that holds them to the same obligations we owe, as UK GDPR Article 28 requires.
We publish the list rather than describing it in general terms because a customer's own data protection obligations depend on knowing who is in the chain, and because a person whose details are in our records is entitled to know where those details go.
Used to run the product and the website
These handle our customers' own data, and the data of anyone who visits this website.
| Who | What they do for us | What reaches them | Where |
|---|---|---|---|
| Stripe Payments UK Ltd | Taking payment and running subscriptions | Name, email, billing address and card details. Card numbers never reach our servers. | UK, with group processing in the US |
| Resend | Sending our own transactional and lifecycle email | Your name, your email address and the contents of the message we send you. | US |
| Vercel | Hosting the website and the app, plus page-view and page-speed measurement | Request data including IP address. The analytics are cookieless and store nothing on your device. | US |
| Railway | Hosting our backend, our worker and our database | Everything in the product, as the infrastructure it runs on. | US |
| Cloudflare | Content delivery, our asset and tracking workers, and email open measurement infrastructure | Request data including IP address. | US, served from UK edge locations |
| Microsoft 365 | Running the hello@leadistry.co.uk mailbox | Anything you put in an email to us. | UK/EU region |
| Microsoft Clarity | Heatmaps and session replay on the public marketing pages | Pages viewed, clicks, scrolls and a replayable recording of the visit. Form fields are masked, and it does not run inside the signed-in product. Loads only if you accept analytics cookies. | US |
| PostHog | Product analytics, autocapture and session replay on the public marketing pages | Events, pages viewed and a replayable recording of the visit. Form fields are masked, and recording does not run inside the signed-in product. Loads only if you accept analytics cookies. | US Cloud |
| Google Analytics 4 | Traffic and page-view measurement | Page views and traffic source, with IP anonymisation. Loads only if you accept analytics cookies. | US |
| Sentry | Error tracking | Error reports, which can incidentally include a user id or a URL. | US |
| Indian Type Foundry (Fontshare) | Serving one of the typefaces on this site | Your browser requests the font file from them, which discloses your IP address and user agent. Its licence requires it to be served from their servers rather than ours. | India |
Used to build the records we hold
These are the ones that matter if you are a company officer or a published business contact in our records rather than a customer. What reaches them is set out in full, because this is the part of the chain that is least obvious from outside.
| Who | What they do for us | What reaches them | Where |
|---|---|---|---|
| Anthropic | Writing the opening line of an outreach email, drafting replies, the setup assistant and search interpretation | Public-record information about a company and, where it is small, its named director, together with the filing fact being written about and the customer's own pitch. When a customer asks us to draft an answer to a reply, the text of that reply as well. | US |
| OpenAI | The same features, used only when a request to Anthropic fails | The same as Anthropic. | US |
| Serper | Running the web searches that find a company's website and a named officer's published contact details | A company name and, where we are looking for a named officer, that officer's name. Nothing about our customers. | US |
| Webshare | The proxy network our crawler uses to fetch public web pages | The page requests themselves. Whatever a company publishes on its own website passes through this connection. | US |
Neither Anthropic nor OpenAI uses data sent through their APIs to train their models, under their commercial API terms.
Transfers outside the UK
Most of the list is in the United States. Those transfers rely on the UK's International Data Transfer Addendum to the EU Standard Contractual Clauses, or on an equivalent mechanism published by the processor. Fontshare is in India and receives nothing but the request for a font file.
Not on this list
Companies House is not a sub-processor. It is a public source we read, under the Open Government Licence. Google and Microsoft are not sub-processors when you connect your own mailbox: that is your own account with them, under your own agreement, and we act on the access you grant.
When this list changes
We will update this page before a new sub-processor starts handling personal data, and we will email account holders at least 30 days before the change takes effect. If you object to a new sub-processor on reasonable data protection grounds, write to hello@leadistry.co.uk and we will work with you to resolve it, up to and including letting you cancel without penalty.
The processing terms themselves are in our Terms of Service, and what we do with personal data generally is in our Privacy Notice.