Sub-processors
These are the service providers G8 ONE Limited uses to run g8-one.com and the G8 ONE app. Each may only use data to provide its service to us, under data protection terms that give equivalent protection to our DPA.
Where your data lives: customer records and files are stored with Supabase in the EU (Ireland), encrypted in transit and at rest. Providers marked “consent only” run only if you choose “Allow” in the cookie banner.
| Provider | What it does | Data involved | Location | Transfer safeguard |
|---|---|---|---|---|
| Supabase Supabase Inc. | Database, sign-in and authentication, file storage (photos, documents), server functions | All customer data and account data | EU – Ireland (AWS eu-west-1) | Data stays in the EU, which the UK recognises as adequate under its adequacy regulations. Standard Contractual Clauses with the UK Addendum cover any support access from outside the UK/EU |
| Netlify Netlify Inc. | Hosting of g8-one.com and app.g8-one.com, content delivery, serverless functions (billing, AI requests), website contact form, AI usage counters | Requests passing through (IP address, browser details), demo form entries, company IDs for usage counts. Customer records are not stored at Netlify | USA, with a global delivery network | Standard Contractual Clauses with the UK Addendum (Netlify DPA) |
| OpenAI (through Netlify AI Gateway) OpenAI, L.L.C., reached via Netlify Inc. | AI features: site photo and video scans, Ask G8, AI search of the audit trail, drafting help for RAMS and COSHH, reading safety data sheets and surveys | Only what you send to an AI feature (text, photos, video frames, documents). Under OpenAI's API terms, this data is not used to train its models | USA | Standard Contractual Clauses with the UK Addendum |
| Stripe Stripe Payments UK Ltd and its affiliates | Subscriptions, card and Direct Debit payments, invoices, one-off purchases (AI credits) | Billing contact name and email, company name, payment details (held by Stripe; we never see full card numbers) | UK, EU and USA | UK GDPR safeguards in Stripe's DPA (Standard Contractual Clauses with the UK Addendum, UK–US data bridge where certified) |
| Resend Plus Five Five Inc. (Resend) | Sending account emails from noreply@g8-one.com: sign-in links, password resets, invitations, reminders | Recipient email address, name and email content | EU – Ireland | Standard Contractual Clauses with the UK Addendum |
| Sentry Functional Software Inc. | Error monitoring and performance; optional masked session replay | Technical error reports (browser, device type, page). Personal data collection is switched off and secret link codes are removed. Session replay only with your permission, with all text and inputs masked | EU – Germany | Standard Contractual Clauses with the UK Addendum |
| Google Analytics Google Ireland Ltd / Google LLC | Visitor statistics – only if you choose “Allow” in the cookie banner | Pseudonymous identifiers, pages viewed, device and approximate location (IP anonymised) | EU and USA | UK–US data bridge and Standard Contractual Clauses with the UK Addendum |
| Microsoft Clarity Microsoft Corporation | Usage heatmaps and session insights – only if you choose “Allow” | Pseudonymous identifiers, clicks and scrolling; form inputs are masked | USA | UK–US data bridge and Standard Contractual Clauses with the UK Addendum |
| Google Fonts Google LLC | Delivers the typefaces used in the app | IP address and browser details of the device loading the font | Global | UK–US data bridge and Standard Contractual Clauses with the UK Addendum |
| OpenStreetMap OpenStreetMap Foundation (UK) | Map tiles and address search (Nominatim) when you add or view a site on a map | The address or place you search for, IP address | UK and EU | UK-based organisation; EU hosting |
| postcodes.io Ideal Postcodes Ltd | Postcode lookup | The postcode only | UK | UK-based |
| SheetJS CDN SheetJS LLC | Delivers the spreadsheet library used for importing and exporting Excel files | IP address and browser details of the device loading the library. Your spreadsheets are processed on your device and are not sent to SheetJS | USA / global | Standard Contractual Clauses with the UK Addendum |
| SDS library service (easycoshh.co.uk) Operated for G8 ONE's safety data sheet search | Searching for and fetching supplier safety data sheets | Product names and supplier names you search for. No personal data | UK / EU (hosted on Netlify) | No personal data is sent |
Changes
We will tell customers at least 30 days before adding or replacing a sub-processor, by email to the account owner and by updating this page, so you can object. Questions: support@g8-one.com.