Firmspotter

Sub-processors

The companies that help us run Firmspotter, what each one does, and what each one can see. Where we use one to handle personal data for a customer, it is a sub-processor.

Last updated 10 November 2026. Version 2026-11-10.

Who they are

  • Supabase

    What it does
    Hosts our database and signs people in.
    What it can see
    Everything the service stores: accounts, the companies a website has seen, business contact details and visit records. IP addresses are only ever in encrypted form.
    Where
    The database is in London. Supabase, Inc. is based in the United States.

  • Vercel

    What it does
    Runs this website and the background jobs.
    What it can see
    Everything that passes through the service while it runs, including a visitor's IP address as a visit arrives.
    Where
    The servers are in London. Vercel Inc. is based in the United States.

  • People Data Labs

    What it does
    Tells us which company an IP address belongs to, and supplies business contact details for people at a company.
    What it can see
    The IP address of a website visitor (to find the company, never a person) and the company we want people for.
    Where
    United States.

  • Anthropic

    What it does
    Writes the researched summaries of companies and the suggested first messages (its AI, Claude).
    What it can see
    A company's name and website and a few facts about it, what a customer says it sells, and, for a suggested message, a person's name and job title. Never an email address or a LinkedIn address.
    Where
    United States.

  • Stripe

    What it does
    Takes payment for plans and extra leads.
    What it can see
    A customer's billing details and what they bought. Never the people found in a lookup.
    Where
    Stripe Payments UK Ltd and Stripe, Inc. (United States).

  • Resend

    What it does
    Sends our emails: sign-in links, alerts to a customer's own team, and receipts for opt-outs.
    What it can see
    The email address it sends to and the message.
    Where
    United States.

  • Cloudflare

    What it does
    Checks that a visitor to our sign-in, sign-up and opt-out pages is a person (Turnstile).
    What it can see
    The visitor's IP address and browser details, when they use one of those pages.
    Where
    A worldwide network. Cloudflare, Inc. is based in the United States.

Who is not on the list

If a customer connects its own Microsoft Teams channel, our alerts go to that channel. Microsoft is then the customer’s own provider, not ours. We never send anything to Teams, or to any address, outside the customer’s own team.

When the list changes

We will update this page before we add a company, or change what one does, and will tell customers at least 30 days in advance. See the privacy notice for how personal data is protected when a company is based outside the UK.

All legal documents