Data protection

Where your data lives and who can see it

The systems we build for you run in London. Here is every service involved, what it holds and where it keeps it.

The short version

  • Your records are stored in London, on Supabase and Vercel. That includes your customers’ personal details.
  • Each client’s data is kept separate.
  • Email and error reports go through the EU, which UK law treats as safe for personal data.
  • Customer assistants: where a system includes one, what customers type into it is sent to an AI service outside the UK to write the reply. We tell you which service it uses before it goes live.
  • We do not put your records into AI tools when we build or support your system.

Services in the systems we build

For the systems we build and run for clients and for our own products.

Service What it does What it holds Where
Supabase Database, sign-in and file storage Your records and user accounts London
Vercel Runs the app The app’s code and request logs. Pages are delivered through Vercel’s worldwide network London, for the app
Resend Sends emails such as sign-in codes and alerts Who each email goes to and what it says EU
Sentry Records errors so we can fix them What went wrong, on which page and in which browser EU (Germany)
An AI service, only where a system has a customer assistant Writes replies to customers’ questions What customers type in, which can include names and contact details Outside the UK. We tell you which service before it goes live
Stripe, Heathmark only Card payments for subscriptions Card and billing details, held by Stripe, never by us Outside the UK
Anthropic (Claude), Heathmark only The optional Claude add-on, planned for 2027 Nothing yet. Once a firm switches it on, complaint text with contact details removed Outside the UK

Who is responsible

For the systems we build for you, you’re the controller of the personal data in them and we’re the processor. We only use it to run and support the system you asked for. Where a supplier keeps data outside the UK, it relies on safeguards recognised under UK data protection law.

This website

This page is about the systems we build. When you use this website, these services handle your data. For what the site collects, such as enquiries and newsletter sign-ups, and the safeguards, see our privacy policy.

  1. Vercel

    Hosts the site and counts page views without cookies. The form handler runs in London.

  2. Resend (EU)

    Delivers what you send through our forms to our inbox and stores newsletter sign-ups.

  3. Google

    Our email and the call booking page.

  4. Cloudflare

    Runs our domain name system and checks forms for spam.

  5. Sentry (EU)

    Records errors on this site. Anything typed into a form is removed first.

Questions about your data?

Ask us before you sign anything. We’ll show you exactly where your data would live.

Book a 20-minute call (opens in a new tab)