Sub-processors
The third parties that process personal data on our behalf, what they do, and where they do it.
Codedevza AI Ltd (Company No. 16485057, registered in England and Wales) uses the following categories of third-party service providers ("sub-processors") to deliver the Operify AI service. Sub-processors process personal data only on our instructions, under contracts that impose confidentiality and data-protection obligations consistent with UK GDPR (and, where relevant, EU GDPR).
Where a sub-processor is located (or processes data) outside the UK/EEA, transfers are protected by appropriate safeguards such as adequacy regulations or standard contractual clauses.
Categories of sub-processors
We engage service providers in the following categories to deliver the Service. We select providers that host and process personal data within the European Union (EU/EEA), with the exception of AI processing for the administrative-console assistant, which takes place in the United States under appropriate safeguards. The specific providers we use may change as the Service evolves; a current, named list is available to organisational customers on request.
| Category | Purpose | Processing location |
|---|---|---|
| Cloud hosting & database | Running the Operify AI platform and storing service data | European Union |
| File / object storage | Storing photos, documents, and signatures uploaded in the app | European Union |
| Email delivery | Sending account invitations and password-reset links | European Union |
| Website analytics (only with consent) | Microsoft Clarity, on operifyai.co.uk only. Shows which pages are read and where visitors get stuck. Text and form fields are masked, so form contents are not captured, and no name or email is sent. Its script does not load unless a visitor accepts analytics in the cookie bar, and is removed when consent is withdrawn | United States |
| Bot protection on website forms | Verifying that a demo request or guide download was submitted by a person, not a script. Processes the IP address and a challenge token, and sets no tracking identifier | Global edge network |
| Error monitoring & diagnostics (where enabled) | Detecting and fixing crashes and technical issues | European Union |
| Product analytics (where enabled) | Understanding aggregate app usage to improve the Service | European Union |
| AI processing (administrative console assistant) | Generating responses for the AI assistant available to organisational administrators, from administrator queries and relevant workspace data (OpenRouter, Inc., configured to route only to model providers that do not retain request data or train on it) | United States (with appropriate safeguards, e.g. standard contractual clauses) |
Each provider processes personal data only on our documented instructions and under contractual confidentiality and data-protection obligations consistent with UK GDPR and EU GDPR.
Changes to this list
We may add or replace sub-processors as the service evolves. We will update this page when we do, and where a Customer Agreement requires it, we will notify organisational customers of material changes in advance and in accordance with that agreement.
Contact
Questions about our sub-processors or international transfers: hello@operifyai.co.uk