Legal
Sub-processors and service providers
Who else handles data when you use Elmetry: the sub-processors that touch what you submit, and the providers we use for accounts, payments and this website.
On this page
- Version
- 2026-10
- Effective
- 1 October 2026
Section 2 lists the sub-processors that may handle personal data in what you submit to the console and API (Sender IDs, URLs, phone numbers and message content). For that data you are the controller and we are your processor, under our Data Processing Agreement.
Section 3 lists the providers involved in running your account, taking payments and serving this website. For that data we are the controller, as our privacy notice explains; some of these providers act as controllers in their own right.
The service itself runs on servers in the United Kingdom, and what you submit is stored there. Where a provider below processes data outside the UK, the transfer is protected as section 4 describes. Where a row names a kind of provider rather than a company, you can ask us at [email protected] which company it is.
| Provider | What it does | Where | Transfer safeguard |
|---|---|---|---|
| Our hosting provider | Data-centre hosting for the servers, databases, storage and backups that run the console and API. | United Kingdom | None needed: data stays in the UK |
| Companies in the Elmsworth Communications Group | Operations and support staff within our group, where needed to provide the service. | Where the group company's staff work | If outside the UK: the IDTA or UK Addendum |
Not a sub-processor: when you run a classification check, the Sender ID or URL being checked is sent, at your instruction, to the messaging platform whose spam system you asked about. The platform receives only that item and handles it under its own terms, possibly outside the UK; it is not bound by a processing contract with us, and the safeguards in section 4 do not cover it. The Data Processing Agreement explains this.
| Provider | What it does | Where | Transfer safeguard |
|---|---|---|---|
| Stripe | Card payments on Stripe's own hosted checkout page. We receive the payment result, not your card details. Stripe acts as a controller for its own fraud and legal duties. | United States and other countries | UK adequacy regulations (UK–US Data Bridge) for certified US organisations; otherwise the IDTA or UK Addendum |
| Google (sign-in) | Only if you choose Sign in with Google: you sign in on Google's page and Google tells us your account identifier and email address. Google acts as a controller under its own privacy policy. | United States and other countries | UK adequacy regulations (UK–US Data Bridge) for certified US organisations; otherwise the IDTA or UK Addendum |
| TronGrid | Lets us read the TRON blockchain to see USDT top-ups arrive. We send it only our own deposit addresses, never your account details. | Outside the United Kingdom | No personal data about you is sent |
| Our email delivery provider | Sends verification codes, password resets and account email to the address on your account. | Ask us for the current provider and location | If outside the UK: UK adequacy regulations (UK–US Data Bridge) for certified US organisations; otherwise the IDTA or UK Addendum |
| Google Fonts | Serves this website's typefaces. Your browser fetches them directly, so Google receives your IP address and browser details. It sets no cookies. | United States and other countries | UK adequacy regulations (UK–US Data Bridge) for certified US organisations; otherwise the IDTA or UK Addendum |
USDT payments are also recorded on the public TRON blockchain, which anyone can read. That is a feature of the network, not a disclosure by us.
When personal data goes to a provider outside the UK, one of the following applies: the destination is covered by UK adequacy regulations (including the UK–US Data Bridge for certified US organisations), or the transfer is made under the ICO's International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, backed by a transfer risk assessment. You can ask for a copy of the relevant safeguard at [email protected].
- Version
- 2026-10
- Effective date
- 1 October 2026
We update this page when we add or replace a provider. For the sub-processors in section 2 we also tell account holders by email or in the console at least 30 days before the change, and you can object as the Data Processing Agreement sets out.
Related documents
- Terms of Service
- 2026-11
- Acceptable Use Policy
- 2026-10
- Privacy Notice
- 2026-11
- Data Processing Agreement
- 2026-11
- Complaints Procedure
- 2026-10
- Accessibility Statement
- 2026-10