Sub-processors
Version of 13 September 2026. Earlier versions are available on request.
Everyone who receives data through Livery, what actually reaches them, and where they are. The complete list, because a partial one is worse than none — you cannot assess a transfer you have not been told about.
This page is generated from the same list the code is checked against. A new third-party service cannot be added to this product without appearing here; that is enforced by a test, not by anyone remembering.
Notice of changes
Where we act as your processor, we tell account holders by email at least 30 days before a new sub-processor starts receiving data, so you have time to object. If you object on reasonable data-protection grounds and we cannot offer an alternative, you may terminate the affected part of the service and be refunded for the unused period. This is the commitment in clause 5 of the data processing agreement.
The list
| Who | What reaches them | Where |
|---|---|---|
| SupabaseSupabase, Inc.The Postgres database. Everything the service stores is here. | Accounts, hashed passwords, organisations, lead records, site content, enquiries, audit logs. | United States (us-east-1, Virginia)Outside the EEA — Standard Contractual Clauses in Supabase's data processing addendum. A move to an EU region is intended; until it happens this is the one transfer that carries real weight. |
| VercelVercel, Inc.Application hosting. | Every request to the service, including IP address and user agent. | United States, with regional deploymentOutside the EEA — Standard Contractual Clauses in Vercel's DPA. The deployment region is not currently pinned — see the note in the privacy notice. |
| PaddlePaddle.com Market LtdMerchant of record for subscriptions: payment, VAT, invoicing and refunds. An independent controller for the payment itself, not merely our processor.your browser contacts them directly | Your name, email, billing country and payment details, which go to Paddle directly. We never see or store card details. | United KingdomOutside the EEA — UK adequacy decision. |
| Google — GeminiGoogle Ireland Ltd / Google LLCDrafting site copy from a business brief. | The business brief you submit: trade, town, services, opening hours and any notes you add. Not your account details. | United StatesOutside the EEA — EU–US Data Privacy Framework; Google LLC is certified. |
| Google — Sign inGoogle Ireland Ltd / Google LLCOptional sign-in, only if you press the button.your browser contacts them directly | An authentication request; returns your email, name and picture. | United StatesOutside the EEA — EU–US Data Privacy Framework. |
| Google — MapsGoogle Ireland Ltd / Google LLCThe map on a generated site, when that site includes one. This is the only third party a client's visitor contacts.your browser contacts them directly | The visitor's IP address and the address being shown. | United StatesOutside the EEA — EU–US Data Privacy Framework. |
| ResendResend, Inc.Sending the one email this product sends: a password reset link. Nothing else is emailed — client invites are handed to the freelancer to send themselves. | The recipient's email address, their first name if they gave one, and the message, which contains a single-use reset link. | United StatesOutside the EEA — Standard Contractual Clauses in Resend's data processing addendum. Only triggered by someone asking for a reset. |
| Cloudflare TurnstileCloudflare, Inc.Anti-bot check on sign-up and on client contact forms.your browser contacts them directly | The visitor's IP address and a browser challenge. | United StatesOutside the EEA — EU–US Data Privacy Framework; Cloudflare is certified. |
| OpenStreetMap — OverpassOpenStreetMap Foundation and independent mirror operatorsFinding businesses in a place during a lead search. | The area and trade searched for. Not your identity. | Germany, Austria, Japan and others, depending on the mirrorOutside the EEA — Mirrors are operated independently and some sit outside the EEA. Only a bounding box and a tag filter are sent. |
| PhotonKomoot GmbHThe second business-discovery source, used because Overpass alone is not reliable enough to sell. | A coordinate, a radius and a category. Not your identity. | GermanyInside the EEA |
| NominatimOpenStreetMap FoundationResolving a place name to a point, where other sources cannot. | The place name or postcode searched for. | United KingdomOutside the EEA — UK adequacy decision. |
| Open-MeteoOpen-Meteo (Patrick Zippenfenig)Resolving a town name anywhere in the world to a point. | The place name searched for. | GermanyInside the EEA |
| Dataforsyningen (DAWA)Klimadatastyrelsen, DenmarkResolving Danish addresses and postal districts. | The postcode or town searched for. | DenmarkInside the EEA |
| Erhvervsstyrelsen (CVR / Virk)Erhvervsstyrelsen, DenmarkCompany lookups against the public register. | The company name or CVR number being looked up. | DenmarkInside the EEA |
| PexelsPexels GmbHStock photograph search, only when you open the picture browser. | The search term. | GermanyInside the EEA |
| OpenverseWordPress FoundationOpenly licensed image search, only when you open the picture browser. | The search term. | United StatesOutside the EEA — Standard Contractual Clauses; only a search term is sent. |
| OllamaSelf-hosted, or Ollama's hosted service if configuredAn alternative model provider. Only in use if the operator configures it; by default nothing is sent here. | The business brief, if and only if this provider is selected. | Wherever the operator runs itInside the EEA |
Transfers outside the EEA
11 of the 17 entries above are outside the European Economic Area. Each row says which mechanism the transfer relies on. The one that carries real weight is the database: it is the only one that holds everything rather than receiving a fragment, and we consider its location a defect we intend to fix rather than a design decision we are defending.
You may request a copy of the Standard Contractual Clauses and the transfer impact assessment for any entry: privacy@liveryhq.com.