Sub-Processor List
Last updated: April 26, 2026
To support the delivery of our Services, Project Paced Ltd (the "Provider") engages third-party entities as "Sub-processors" to assist with data processing activities. Under the UK GDPR, a sub-processor is a third-party data processor engaged by us who has or potentially will have access to or process personal data (which may include Customer Data).
1. Infrastructure & Core Processing
These sub-processors provide the foundation of our platform, including hosting, database management, and AI computation.
| Entity Name | Purpose | Location | Transfer Mechanism |
|---|---|---|---|
| Google Cloud Platform | Cloud infrastructure, database (Firestore), file storage, and application hosting. | Standard instance: Firestore in nam5 multi-region (Iowa, Oklahoma, South Carolina); Cloud Functions and Cloud Storage in us-central1. EU instance: Firestore in eur3 multi-region (Belgium, Netherlands, Finland); Cloud Functions and Cloud Storage in europe-west1. | UK IDTA / SCCs (standard); no restricted transfer (EU instance — data remains in EU) |
| Google Vertex AI | AI-driven timeline generation. (Note: Enterprise API; data not used for model training). | us-central1 (standard instance); europe-west1 (EU instance) | UK IDTA / SCCs (standard); no restricted transfer (EU instance) |
| Google reCAPTCHA Enterprise | Bot and abuse prevention via Firebase App Check — verifies that requests originate from our official web application. Governed by the Google Cloud Data Processing Addendum (Google acts as data processor for reCAPTCHA Enterprise). | USA / Global | UK IDTA / SCCs |
| Resend, Inc. | Transactional email delivery (contact form submissions, welcome emails). | USA | UK IDTA / SCCs |
| Vercel, Inc. | Frontend deployment, MCP server (mcp.projectpaced.com), and global content delivery (CDN). | Global | UK IDTA / SCCs |
2. Business Operations & Finance
These sub-processors handle the commercial side of our relationship with you, including billing and subscription management.
| Entity Name | Purpose | Location | Transfer Mechanism |
|---|---|---|---|
| Stripe, Inc. | Payment processing, fraud prevention, and subscription billing. Used on the standard instance only — EU enterprise customers are billed via manual invoice. | USA / Global | PCI-DSS Level 1 & SCCs |
3. Monitoring & Analytics
These sub-processors help us maintain a high-quality service by monitoring performance and identifying feature friction.
| Entity Name | Purpose | Location | Transfer Mechanism |
|---|---|---|---|
| Google Analytics (GA4) | Product analytics and funnel optimization. (Anonymized IP tracking enabled). | USA / Global | UK IDTA / SCCs |
| Sentry (Functional Software, Inc.) | Error tracking and session replays. (Client-side PII masking enforced). | USA | UK IDTA / SCCs |
| Better Stack | System uptime and performance monitoring. | EU / USA | DPA in place |
4. Updates and Objections
As our business grows, we may update this list.
- Notification: We will notify registered users of any new sub-processors via email or an in-app notification.
- Right to Object: Pursuant to our Data Processing Agreement (DPA), customers may object to the appointment of a new sub-processor on reasonable grounds related to data protection within 30 days of notification.
5. Definitions
- UK IDTA: UK International Data Transfer Agreement.
- SCCs: Standard Contractual Clauses approved by the European Commission and adopted in the UK.
- PII: Personally Identifiable Information.
Contact: support@projectpaced.com Registered Office: Project Paced Ltd, International House, 64 Nile Street, London, N1 7SR, United Kingdom.