Kerbline
These are the companies that store or process customer data for Kerbline. For what is on a site — photographs, messages, times and locations — our customer is the controller and we are the processor, so these companies are our sub-processors. We have a contract with each of them, and we remain responsible to our customers for what they do with the data.
We tell customers before we add a new sub-processor. We email the administrator of each organisation at least 30 days before a new sub-processor starts handling customer data, and update this page. If you object on data protection grounds, Schedule 1 of our terms says what happens next.
Current sub-processors
-
Supabase Inc.
Database, file storage and sign-in- What it does for Kerbline
- Holds the Kerbline database and file storage, and runs sign-in.
- Data it handles
- Everything on a site: photographs, messages, the time and location recorded with them, and retained voice notes. Account details: names, email addresses, roles, and sign-in records.
- Where
- Stored in the United Kingdom (London). Supabase is a United States company. Stored files are delivered through Cloudflare, Inc., which Supabase uses as its own sub-processor.
-
Cloudflare, Inc.
Backup storage, since 20 September 2026- What it does for Kerbline
- Keeps a copy of every stored file, made each night, so that files can be recovered if the originals are lost.
- Data it handles
- Copies of every file in Kerbline's file storage, including every photograph. We keep the last 30 nightly copies, so a file deleted from Kerbline stays in the backup for up to 30 days. The copies are encrypted in transit and at rest.
- Where
- European Union: the backup storage is restricted to Cloudflare's EU jurisdiction. Cloudflare is a United States company; any transfer of data to it is covered by the UK Extension to the EU–US Data Privacy Framework, under Cloudflare's data processing addendum.
-
Railway Corp.
Backend hosting- What it does for Kerbline
- Runs Kerbline's backend server, which builds evidence packs, sends messages for translation, handles billing and sends notifications. Also runs the nightly backup job.
- Data it handles
- Site content and account details pass through it while the service is in use, and every stored file passes through it each night on its way to the backup. It does not keep a copy of the database or of stored files.
- Where
- European Union (the Netherlands). Railway is a United States company.
-
Vercel Inc.
App and website hosting- What it does for Kerbline
- Serves the Kerbline web app and this website, and runs the website's contact and demo-request forms.
- Data it handles
- The app's code, which runs in your browser, not your site content. What someone types into a form on this website: their name, email address and message.
- Where
- United States.
-
Anthropic PBC
Message translation- What it does for Kerbline
- Translates messages for people who read Kerbline in a language other than English.
- Data it handles
- The text of the message being translated. Names, photographs and locations are not sent.
- Where
- United States.
-
Resend, Inc.
Email delivery- What it does for Kerbline
- Sends the account emails from our sign-in service (sign-up confirmation and password resets), and sends us the enquiries made through this website.
- Data it handles
- Email addresses, and the content of those emails. No site content.
- Where
- United States.
-
Stripe
Payments- What it does for Kerbline
- Takes subscription payments.
- Data it handles
- The billing contact's name and email address, the organisation's billing details, and card details. We do not store full card details ourselves.
- Where
- Republic of Ireland and United States.
Companies that are not sub-processors
Some companies receive data because of the device or browser someone uses, not because we chose them. We have no contract with them and cannot give them instructions, so they are not on the list above. Our privacy notice describes each one in full:
- Push notification services run by Apple, Google, Mozilla and Microsoft. Your browser chooses which one, and only if you turn notifications on. Each notification is encrypted so that the service cannot read it.
- OpenStreetMap map images, only when someone opens the map view of a photo gallery.
- Have I Been Pwned, which checks a new password against known breaches. The password itself is never sent.
Changes to this list
- 26 September 2026. This page published. Cloudflare, Inc. added for backup storage, in use since 20 September 2026. Railway's location corrected to the European Union. Resend's purpose corrected to include account emails.
- 26 September 2026. GitHub, Inc. removed. It ran the nightly backup job from 20 September 2026, and each stored file passed through it without being kept. The job now runs on Railway, in the European Union, so GitHub no longer handles customer data.
Questions about this list: privacy@kerbline.co.uk