Sub-Processors and International Transfers Annex
Last updated: May 2026
This annex identifies VetFlash service providers and sub-processors that may process personal data for the VetFlash website, platform, AI features, payments, hosting, scheduling, and embedded content.
Customers should note that some providers may act as independent controllers for parts of their services, particularly payment providers. Where a provider acts as an independent controller, its own privacy notice and terms also apply.
1. International Transfer Wording
VetFlash may use service providers located in the United Kingdom, the European Economic Area, the United States, and other jurisdictions where necessary to provide, secure, support, maintain, analyse, or improve the Services.
Where personal data is transferred outside the United Kingdom, VetFlash will use a transfer mechanism permitted by Chapter V of the UK GDPR.
- UK adequacy regulations;
- the UK International Data Transfer Agreement;
- the UK Addendum to the EU Standard Contractual Clauses;
- the UK Extension to the EU-US Data Privacy Framework, where valid and applicable;
- another lawful transfer mechanism available under UK data protection law.
2. Sub-Processor Register
| Provider | Address | Contact | Service | Data processed | Location | DPA / terms | Transfer notes |
|---|---|---|---|---|---|---|---|
| OpenAI, LLC | 548 Market St, PMB 12230, San Francisco, CA 94104, USA | privacy@openai.com | AI generation via API, including flashcards and summaries | Prompts, API inputs, generated outputs, metadata required to provide the API | USA | OpenAI Business DPA | API data not used for training where covered by OpenAI API/Business terms. Customer content should be minimised. Transfer mechanism to be confirmed from OpenAI DPA. |
| Deepgram, Inc. | 111 Town Square Place, Suite 1203, Jersey City, NJ 07310, USA | privacy@deepgram.com | Speech-to-text and audio transcription processing | Audio files/streams, transcripts, metadata required for transcription | USA | Deepgram Terms and DPA | Audio may contain personal data if users include it. Transfer mechanism to be confirmed from Deepgram DPA. |
| Perplexity AI, Inc. | 315 Montgomery St, 10th Floor, San Francisco, CA 94104, USA | privacy@perplexity.ai | Search-grounded AI processing via API | Prompts, queries, generated responses, search/retrieval metadata | USA | Perplexity Privacy/DPA | Transfer mechanism and DPA status should be confirmed from account/legal documentation. |
| Requesty | San Francisco, CA, USA. Exact contracting entity to be verified in dashboard. | support@requesty.ai | AI API gateway and routing | Prompts, routing metadata, provider responses, API metadata | USA | Requesty developer dashboard | Routes prompts to various LLMs. Exact entity, sub-processors, retention, training, and transfer mechanism must be verified in the dashboard. |
| IONOS Cloud Ltd | Discovery House, 154 Southgate St, Gloucester, GL1 2EX, UK | privacy@ionos.co.uk | Primary cloud infrastructure and database hosting | Account data, platform data, database content, logs, backups, uploaded content where hosted | UK / EEA | IONOS DPA | UK/EEA hosting. Confirm exact data centre region and any support access locations. |
| 123 Reg Limited | Studio 4, Tollhouse Hill, Nottingham, NG1 5FW, UK | privacy@123-reg.co.uk | Domain management and secondary web hosting | Domain/account administration data, DNS records, website hosting data | UK | 123 Reg DPA | Confirm whether secondary hosting processes live platform personal data. |
| Stripe Payments UK Ltd | 9th Floor, 107 Cheapside, London, EC2V 6DN, UK | Stripe Privacy Form | Subscription payment processing | Billing details, transaction metadata, payment identifiers, fraud prevention data | UK / Ireland / USA | Stripe DPA | Stripe may act as processor and/or independent controller depending on activity. VetFlash should not store full card data. |
| PayPal UK Ltd | 5 Fleet Place, London, EC4M 7RD, UK | PayPal Privacy Portal | Payment processing, including wallet payments | Billing details, transaction metadata, payer details, fraud prevention data | UK / USA | PayPal business data protection terms | PayPal may act as independent controller for wallet/payment account services. |
| Vimeo, LLC | 555 West 18th St, New York, NY 10011, USA | privacy@vimeo.com | Video hosting and embedded tutorial player | Viewer identifiers, device data, usage analytics, video interaction data | USA | Vimeo DPA webform | Embedded player may set cookies or track usage. Cookie consent controls should apply where required. |
| Calendly, LLC | 115 E Main St, Ste A1B, Rock Hill, SC 29730, USA | privacy@calendly.com | Scheduling for VetFlash demos | Names, email addresses, scheduling details, meeting metadata | USA | Calendly DPA | Scheduling data may transfer to the USA under Calendly transfer terms. |
| Simple Analytics | EU (see website) | support@simpleanalytics.com | Privacy-focused website analytics | Anonymised page views, referrer, device/browser type, country-level location. No cookies, no personal data collected. | EU | Simple Analytics GDPR Information | No personal data collected by default. No cookies used. Privacy-friendly alternative to Google Analytics. |
| Google (Workspace) / Google Ireland Ltd | Google Ireland Ltd, Gordon House, Barrow St, Dublin 4, Ireland / Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA | privacy@google.com | Backup storage via Google Drive / Google Workspace | Backup files containing platform data including account records, prompts, audio, transcripts, uploads, logs, and database exports where applicable | Ireland (primary) / USA (secondary) | Google Workspace DPA | Data stored in Ireland by default; may be accessed from USA under Google's transfer mechanism (SCCs / UK Addendum / DPF). VetFlash controls access to backup data and restricts it to authorised administrators. Backups are encrypted where supported by Google Workspace settings. |
3. Sub-Processor Change Notice
VetFlash should provide notice of material new sub-processors where commercially reasonable.
Customers may object to a new sub-processor on reasonable data protection grounds.
Vendor Review
VetFlash reviews providers before use and periodically thereafter, including their role, processing purpose, locations, transfer safeguards, data protection terms, security measures, retention settings, and onward sub-processors where relevant.