Our third-party service providers and sub-processors
Last updated: 6 October 2026
This list includes sub-processors used to deliver the Diggle service and providers used for our own business operations. Providers act as sub-processors under our customer DPA only to the extent they process personal data on our behalf when we act as a processor for a customer. Some providers may also act as independent controllers for certain processing activities.
|
Service provider
|
Reason
|
Country
|
Legal grounds for transfer
|
Data processing terms
|
Categories of personal data that may be processed
|
Which service
|
|---|---|---|---|---|---|---|
|
Scaleway
|
Hosting for servers, managed databases and backups; monitoring, logging and diagnostics through Scaleway Cockpit.
|
France
|
Not applicable (EEA)
|
User account information (email, username, name), IP addresses, access logs, information which the Account Holder collects using the system, and application logs, monitoring metadata and diagnostic information that may contain personal data.
|
The App
|
|
|
Hetzner Online GmbH
|
Disaster recovery and standby hosting for database and user-uploaded content.
|
Finland (Helsinki)
|
Not applicable (EEA)
|
User account information (E-mail, username, name), IP addresses, access logs, customer-created content and participant responses, user-uploaded images and associated metadata.
|
The App
|
|
|
DigitalOcean, LLC
|
Hosting for the public website and help centre.
|
Netherlands (Amsterdam, AMS3); US-based provider with international processing.
|
EU-U.S. Data Privacy Framework; SCCs as fallback
|
IP addresses, access logs
|
Public website and Help Centre.
|
|
|
Scaleway
|
Stores user uploaded images
|
France
|
Not applicable (EEA)
|
User-uploaded images and associated metadata
|
The App
|
|
|
Cloudflare, Inc.
|
DNS for diggle.com and its subdomains; CDN and proxy-based security for the public website and help centre; Turnstile bot and abuse protection for website forms and for signup and authentication flows in The App.
|
United States
|
EU-U.S. Data Privacy Framework; SCCs as fallback
|
IP addresses, browser and device information, DNS query metadata, website request and response data for proxied web properties, and interaction and security signals used by Turnstile, including TLS fingerprint, User-Agent, sitekey and associated origin.
|
Public website and Help Centre; The App and API
|
|
|
Google Cloud EMEA Limited
|
Email provider and video chat provider for Diggle/Specifique employees.
|
Ireland (with international processing)
|
Not applicable for EEA transfer; DPF/SCCs for restricted onward transfers
|
Employee names and email addresses; email content and attachments; meeting participant information and audio/video content; customer information included in communications.
|
N/A
|
|
|
Scaleway
|
Sending transactional emails
|
France
|
Not applicable (EEA)
|
Email addresses, names, usernames, email subject lines and message content, and delivery metadata and logs (including timestamps, delivery status and error information).
|
The App
|
|
|
Stripe Payments Europe, Limited
|
Payment processing and billing for individual licences only. Stripe also acts as an independent controller for certain activities, including fraud prevention, regulatory compliance and improvement of its services.
|
Ireland (with international processing)
|
EU-U.S. Data Privacy Framework; SCCs as fallback.
|
Payment method information, billing details, email addresses, names, usernames, customer identifiers, subscription and transaction records, and technical and fraud-prevention data (such as IP addresses, device information and risk signals), where collected through the payment integration.
|
The App
|
|
|
Slack Technologies Limited
|
Internal communication
|
Ireland (with US/international processing)
|
Not applicable for EEA transfer; DPF/SCCs for restricted onward transfers
|
Employee names, email addresses and profile information; messages, files and interaction metadata
|
N/A
|
|
|
Scaleway
|
Generative AI hosting and processing
|
France
|
Not applicable (EEA)
|
AI prompts, Diggle content, participant responses and generated output
|
The App
|
|
|
Sendinblue SAS (Brevo)
|
Marketing and contact management; transactional email delivery from the Landing Page
|
France
|
Not applicable for transfers within the EEA; DPF or SCCs for onward transfers, where applicable.
|
Email, name, account status, plan, activity, and form submission content
|
The App / The Landing Page
|
|
|
Google Cloud EMEA Limited
|
Dynamic interface translation
|
Ireland (with international processing)
|
Not applicable for EEA transfer; DPF/SCCs for restricted onward transfers
|
Text submitted for translation and associated request metadata
|
The App
|
|
|
CookieYes Limited
|
Cookie consent management
|
United Kingdom (with international processing)
|
EU adequacy decision for the UK; SCCs for restricted onward transfers
|
IP address, geolocation based on IP, cookie/consent information and request metadata
|
The Landing Page
|
|
|
Google Cloud EMEA Limited
|
reCAPTCHA login security and abuse prevention
|
Ireland (with international processing)
|
Not applicable for EEA transfer; DPF/SCCs for restricted onward transfers
|
IP address, browser/device information, interaction and security/risk signals
|
The App
|