Sub-processor List
Priceguide Ltd Last updated: 26 April 2026 Version: 1.1
This page lists the third-party service providers (“Sub-processors”) that Priceguide Ltd engages to operate the Priceguide platform and that may process personal data on behalf of our customers. We update this list when Sub-processors are added, replaced, or removed.
To receive notifications of changes, please email [email protected] and ask to be added to the notification list. Customers will receive at least thirty (30) days’ notice of changes by email and via the in-product announcement banner, in accordance with our Data Processing Agreement.
How we engage Sub-processors
Before engaging a Sub-processor that will process customer personal data, we:
- Confirm the Sub-processor offers data processing terms at least as protective as ours, which may take the form of the Sub-processor’s published data processing addendum.
- Review the Sub-processor’s security certifications (SOC 2 Type II, ISO 27001, or equivalent).
- Confirm appropriate international transfer mechanisms are in place where relevant.
- Document the categories of data they will process and the purpose.
We review active Sub-processors annually.
Core platform Sub-processors
These providers process Customer Personal Data as part of operating the Priceguide platform.
| Sub-processor | Purpose | Data processed | Location of processing | Transfer mechanism |
|---|---|---|---|---|
| Vercel Inc. (San Francisco, CA, USA) | Application hosting, edge compute, serverless functions, content delivery | All platform data — accounts, estimator submissions, lead data, logs | United States primary, with global edge presence | EU SCCs + UK Addendum; EU-US DPF (Vercel certified) |
| Cloudflare, Inc. (San Francisco, CA, USA) | DNS, CDN, DDoS protection, WAF, edge security | Network metadata, IP addresses, request headers, cached static assets | Global edge network with primary metadata processing in the United States | EU SCCs + UK Addendum; EU-US DPF |
| Auth0 (Okta, Inc.) (San Francisco, CA, USA) | Identity, authentication, MFA, session management for customer users | User email, hashed password, authentication metadata, IP address, device info | United States | EU SCCs + UK Addendum; EU-US DPF (Okta certified) |
| OpenAI, L.L.C. (San Francisco, CA, USA) | LLM inference for content generation, estimator descriptions, AI-assisted features | Anonymised question/answer content and estimator configuration data. PII (name, email, telephone, full address) is not sent to OpenAI. | United States | EU SCCs + UK Addendum. OpenAI’s API terms, as currently in force, do not permit the use of customer API data to train their models. |
| Airtable, Inc. (San Francisco, CA, USA) | Structured data storage for analytics and franchise dashboard back-end | Aggregated and customer-level analytics data; lead metadata for franchisor reporting features | United States | EU SCCs + UK Addendum; EU-US DPF |
| Twilio Inc. (SendGrid) (San Francisco, CA, USA) | Transactional and notification email delivery (lead notifications, account emails, password resets) | Recipient email address, name, content of transactional emails | United States | EU SCCs + UK Addendum; EU-US DPF (Twilio certified) |
| Stripe, Inc. (San Francisco, CA, USA) | Payment processing for Priceguide subscriptions | Customer billing name, email, billing address, last four digits of card, transaction metadata. Full card numbers do not transit Priceguide systems — Stripe Elements is used. | United States | EU SCCs + UK Addendum; EU-US DPF (Stripe Inc. certified). Stripe is also an independent controller for fraud prevention and regulatory compliance purposes. |
| Hotjar Ltd (St Julian’s, Malta) | Product analytics on the customer dashboard (app.priceguide.ai) — session recordings and heatmaps used to improve the customer-facing product experience | Customer dashboard user activity (pages visited, clicks, scroll, IP address, device/browser metadata). Hotjar is configured to suppress user input by default. | European Union (Hotjar primary) | Intra-EEA processing for EU/UK data subjects; EU SCCs + UK Addendum for any onward US transfer by Contentsquare (Hotjar’s parent) |
Marketing site Sub-processors (priceguide.ai only)
These providers operate on the public marketing website and do not process estimator end-user data.
| Sub-processor | Purpose | Data processed | Location | Transfer mechanism |
|---|---|---|---|---|
| Google LLC (Google Analytics 4) (Mountain View, CA, USA) | Website analytics on priceguide.ai | Pseudonymised visitor identifiers, page views, device/browser, IP address (truncated), behavioural events | United States, with EU regional data centre options | EU SCCs + UK Addendum; EU-US DPF (Google certified) |
| Meta Platforms, Inc. (Meta Pixel) (Menlo Park, CA, USA) | Advertising measurement and retargeting on priceguide.ai | Pseudonymised visitor IDs, page views, conversion events, hashed contact identifiers (where provided) | United States | EU SCCs + UK Addendum; EU-US DPF (Meta certified) |
| ActiveCampaign, LLC (Chicago, IL, USA) | Marketing automation, newsletter delivery, and visitor tracking on priceguide.ai (lead capture forms, email campaigns, on-site behaviour tracking for marketing automation) | Email address, name, marketing preferences, page views on priceguide.ai, engagement events (opens, clicks), submitted form data, IP address | United States | EU SCCs + UK Addendum per ActiveCampaign’s published data processing addendum |
The Meta Pixel and Google Analytics 4 are loaded only on the public marketing website (priceguide.ai). They are not loaded on customer-facing estimators or in the customer dashboard, and they do not process estimator submissions.
Stripe — controller/processor relationship note
Stripe acts as our processor with respect to processing payment information on our behalf to deliver the Service. For its own fraud prevention, regulatory compliance, and risk management purposes, Stripe acts as an independent controller and is governed by Stripe’s own privacy policy. Customers should review Stripe’s privacy notice at stripe.com/privacy.
Development partner
| Sub-processor | Purpose | Data processed | Location | Transfer mechanism |
|---|---|---|---|---|
| SpinUp Ltd (Development partner) | Engineering, infrastructure, support | Limited access to production systems for development and incident response | United Kingdom | UK domestic processing; UK GDPR applies directly |
SpinUp is engaged under a contractual relationship that includes confidentiality obligations and is treated as a Sub-processor for the purposes of any production data access.
Other service providers
The following tools are part of our internal operations but do not process Customer Personal Data, or process only Priceguide’s own corporate data (e.g., our employee email, our own business records). They are listed here for transparency only and are not Sub-processors of Customer Personal Data:
- Google Workspace — internal email and document collaboration for Priceguide staff.
- GitHub — source code hosting. Code does not contain customer personal data.
How to subscribe to change notifications
Customers are notified of Sub-processor changes via the email address associated with the account billing contact. To add additional recipients, please email [email protected] with the names and email addresses to add.
Right to object
Customers may object to a new or replacement Sub-processor on reasonable data protection grounds within fifteen (15) days of notice, as set out in Section 6 of our Data Processing Agreement.
Contact
Priceguide Ltd 167-169 Great Portland Street, 5th Floor London W1W 5PF, United Kingdom
Have Any Questions?
We’d love to hear from you.