Legal
Subprocessors
Last updated · 18 September 2026
Terms · Privacy · DPA · Subprocessors
What this page is
Mighty Andy uses third-party providers to operate the Service. Where one of them processes personal data contained in material you upload, it is a subprocessor under our Data Processing Agreement.
This page is the authoritative list. The DPA points here rather than naming providers inline, so the published position stays accurate as the stack changes.
We update this page before a new subprocessor begins processing Customer Content. To be notified of changes, write to [email protected].
What we commit to
These apply to every provider on this page, and to any provider added to it.
- No provider is permitted to train general-purpose AI models on Customer Content. Where a provider processes it, that processing is transient and only to perform the work.
- Each provider receives only the information reasonably required for its function. Most never see uploaded material at all.
- Each is engaged under data-protection obligations materially equivalent to those in our Data Processing Agreement, and we remain responsible to you for what they do.
- This page is updated before a new provider begins processing Customer Content, so you can object before it happens.
Current subprocessors
| Provider | Function | Customer Content? | Processing location |
|---|---|---|---|
| Cloudflare | Hosting, application delivery, object storage, database and edge security for the Service. | Yes — uploaded material, Run records and outputs are stored and served here. | Global edge network, with primary storage configured for the EU / UK. |
| Model inference | Language-model inference for the analysis that produces a diagnostic. See Model inference below for the providers in this category. | Yes — processed transiently to perform a Run, and never used to train general-purpose models. | EU, UK and United States, depending on the provider. |
| Stripe | Payment processing and billing. | No — purchase and payer details only. | United States and EU. |
| Resend | Transactional email — delivery notifications, report links and support correspondence. | Incidental — only where included in a message or its attachments. | United States and EU. |
| Waitlist and prospective-customer contact handling for the website. | No — professional contact details submitted through the website only. | United States and EU. |
Model inference
Analysis is not tied to a single model vendor. Inference for a Run may be routed to any of the approved providers below, and which one handles a given Run depends on the analysis required, capacity and operational judgment at the time.
The approved set is:
- Anthropic, OpenAI and Mistral AI, under business or enterprise terms that exclude training on submitted content
- Models operated by Mighty Andy on its own managed infrastructure, including open-weight models run in an isolated environment with no third-party inference provider involved
The same commitments apply across the whole set: transient processing, no training on Customer Content, and no use of your material for any purpose other than performing your Run.
Adding a provider to this set is a change to this page and is published before that provider begins processing Customer Content. Moving work between providers already on the list is an operational decision and is not separately notified.
If your organisation needs a particular provider excluded, or needs a Run kept to Mighty Andy-operated models only, write to [email protected] before submitting material and we will tell you whether we can accommodate it.
Transfers
Where a subprocessor processes personal data outside the United Kingdom or the European Economic Area, Mighty Andy relies on an appropriate transfer mechanism as described in clause 7 of the Data Processing Agreement. This may include an adequacy decision, the European Commission’s Standard Contractual Clauses, or the UK International Data Transfer Agreement or Addendum.
Objecting to a subprocessor
Customers may object to a new subprocessor on reasonable data-protection grounds within 30 days of this page being updated. The process is set out in clause 6 of the Data Processing Agreement.
Changes
This page is updated when a subprocessor is added, removed, or its function materially changes. The date at the top of the page reflects the most recent change.