Legal
Sub-processors
Build Assure Limited
Annex 3 of the Data Processing Agreement · Version 0.5 · Last updated: ⟦DATE⟧
The following sub-processors are authorised to process Customer personal data. This list is kept current and made available to Customer on request, together with advance notice of any proposed change under Section 7.
Authorised sub-processors
| Sub-processor | Service provided | Processing location | Transfer safeguard |
|---|---|---|---|
| Supabase | Database, authentication and file storage underlying the platform | AWS eu-west-2 (London, UK) | UK-hosted; no restricted transfer |
| Vercel | Application hosting and content delivery | London region where configured | UK-hosted where configured; IDTA or Addendum for any processing outside the UK |
| Resend | Transactional and system email delivery | EU/UK region where configured | IDTA or Addendum, plus transfer risk assessment, for any processing outside the UK |
| Anthropic | AI-assisted features (Claude API) | United States | IDTA or Addendum, plus Anthropic's data processing terms |
| AI-assisted features (Gemini API) | United States, or the Google Cloud region configured for the endpoint in use | IDTA or Addendum, plus Google's Cloud Data Processing Addendum |
No monitoring, analytics or payment sub-processor is currently engaged. Any such engagement will be added to this Annex with advance notice under Section 7.
AI providers and your data
Customer data submitted to either AI provider is processed only to return the requested output for the relevant feature, is limited to the data needed for that feature, and is not used to train the providers' models under their applicable commercial terms. AI output assists a human user and is not used to make final safety-critical or statutory decisions.
Transfers outside the UK
Where a sub-processor processes personal data outside the UK, BuildAssure will ensure an appropriate safeguard is in place — UK adequacy ("data bridge") regulations where applicable, or the UK International Data Transfer Agreement or the International Data Transfer Addendum to the EU Standard Contractual Clauses — supported by a transfer risk assessment applying the test as reworded by the Data (Use and Access) Act 2025.
Changes to this list
BuildAssure will give Customer at least 30 days' advance notice of any intended addition or replacement of a sub-processor, allowing Customer to object on reasonable data-protection grounds; if the objection cannot be resolved in good faith, Customer may terminate the affected part of the Service as its exclusive remedy.
Page note — not part of the agreement
To be told when this list changes, write to buildassureapp@gmail.com. There is no subscription control for change notices yet; notice is given under Section 7 to the customer contact on the account.
Known gap — disclosed, not yet in Annex 3
The platform contains a drawing-analysis capability which sends a whole uploaded CAD drawing file and its filename to a separate extraction service. That service is not yet named in Annex 3 of our Data Processing Agreement. Section 7 of that agreement requires us to give Customers at least 30 days' advance notice before adding a sub-processor, and adding this one is subject to that notice.