Legal
Subprocessors
Every third party that touches data on our behalf, what it does, where it processes, and the transfer mechanism. Updated 30 days before any addition.
Draft pending legal review. This document has not yet been reviewed by a lawyer. Send questions to hello@steelcitysites.co.uk.
Last updated
Every third party that processes data on our behalf is listed here. Each is engaged under a written agreement with obligations at least as protective as our own DPA, and each is assessed before it processes anything.
We give at least 30 days' notice before a new subprocessor starts, by email to workspace owners and by updating this page. Subscribe to changes by emailing hello@steelcitysites.co.uk with the subject "subprocessor updates".
Infrastructure
| Subprocessor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Supabase | Primary database, authentication, row-level isolation | EU (Frankfurt) | N/A, EEA |
| Railway | Web application, background worker and Redis hosting | EU deployment | SCCs + UK Addendum |
| Cloudflare R2 | Object storage for uploads, renders and exports | EU | SCCs + UK Addendum |
AI model providers
Each of these is contractually prohibited from training on data we send, and retains it only for the short abuse-monitoring window its terms require.
| Subprocessor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Anthropic | Draft generation, classification, summarisation | US | SCCs + UK Addendum |
| OpenAI | Draft generation, embeddings for search and matching | US | SCCs + UK Addendum |
| Deepgram | Speech-to-text for video, audio and voice questions | US | SCCs + UK Addendum |
| Replicate | Image and video rendering models | US | SCCs + UK Addendum |
Communications
| Subprocessor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Resend | Transactional and product email | US | SCCs + UK Addendum |
Business operations
| Subprocessor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Stripe | Payments, subscriptions, tax calculation, invoices | US and EU | SCCs + UK Addendum |
Publishing partners
X and TikTok publishing through Ayrshare is not connected. The current app does not use an external publishing partner for those destinations.
Optional services
The application has code paths for Anthropic, Deepgram, Replicate, Cloudflare R2 and Stripe. Their use depends on configured credentials and the tool being run; listing a service here does not mean every related feature is enabled. The current deployment uses OpenAI for configured AI requests. Mail uses the Resend account configured by the workspace. SMS, WhatsApp, affiliate tracking and third-party analytics are not connected.
Not subprocessors
The platforms you connect — Instagram, YouTube, Discord, Shopify, your podcast host, your email provider — are not our subprocessors. When Ownerbar posts to them, that is you acting on your own account through software you authorised. Your relationship with those platforms is governed by their terms, not ours.
Changes to this page
| Date | Change |
|---|---|
| 2026-09-01 | Initial published list |
Questions
hello@steelcitysites.co.uk. Contact us if you need a signed DPA or details about the services used for your workspace.