Sub-processors List
Third-party service providers we use to operate the Y.O.D.O. Service.
Version 2.4.0 effective 28 June 2026Last Updated
Company: Y.O.D.O. Ltd (Company No. 15736034)
Registered Office: 42 Mayfair Gardens, Southampton, SO15 2TW, United Kingdom
ICO Registration: ZC015883 (Data Protection Lead: Mrs Theodosia Kouraki)
EU Representative under Article 27 EU GDPR: Christina-Eloiza Kouraki, Marasli 29, Athens 10676, Greece, email eloizakouraki@yahoo.gr.
Contact: info@yodo.ltd
Toggle changelog details. What changed in v2.4.0 (02 June 2026 (Effective 28 June 2026))
Version 2.4.0 · 02 June 2026 (Effective 28 June 2026)
- Added four providers already in use that were omitted from this list: ScoutAPM, Honeybadger, Better Stack and GitHub. Correction of an omission; these providers were already engaged under Article 28 terms and no new processing begins.
Earlier revisions
Version 2.3.0 · 28 May 2026 (Effective 28 June 2026)
- Added Google Ireland Limited (with Google LLC for US support routing) as a new sub-processor for business email and Google Drive document storage (Google Workspace Business Starter). Inbound mail to info@yodo.ltd, including data subject rights requests and support correspondence, is processed by Google. Shared operational documents are stored in Google Drive.
- The 30-day advance notice required by §5 was issued by email to all active Account Holders on 28 May 2026; the change takes effect on 28 June 2026.
Version 2.1.0 · 15 May 2026
- EU Representative under Article 27 EU GDPR appointed: Christina-Eloiza Kouraki (Athens, Greece). EU/EEA queries now route to the appointed representative.
- §5 now commits to 30 calendar days' advance email notice to Account Holders before any material sub-processor change (with an emergency-change carve-out and a customer objection route under any DPA).
- Added Apple Distribution International (iCloud, EU/Ireland) for engineering-contractor work-device backup, Slack Technologies (US) for internal operational notifications, and the engineering contractor (Lithuania) as a sub-processor by role.
- Partner referral note updated from 6 months to 3 months redemption window (aligned to Terms Schedule F).
Version 1.9.0 · 14 May 2026
- Added Google LLC and LinkedIn Corporation as Identity Providers for Account Holder single sign-on.
- Twilio row expanded to Twilio Ireland Limited; clarified dual role (sign-up OTP + Status Check escalation SMS).
- Persona row clarified: engaged only at Delegate Passing reports and Recipient enhanced-verification access.
This Subprocessor List explains the third-party service providers we use to operate the Y.O.D.O. website and web application (together, the Service). It is intended to support transparency and align with our Privacy Policy.
This list covers providers we use to process personal data on our behalf for the Service. It does not cover:
- your own email, phone, or internet provider,
- providers used by Delegates/Recipients on their own devices,
- external sites you may visit via links.
If there is any conflict between this document and the Privacy Policy, the Privacy Policy takes priority for data protection matters.
1. What we mean by "subprocessor"
A subprocessor is a third party we use to process personal data on our behalf to provide the Service (for example hosting, email delivery, identity verification, payments, security). We have data processing agreements or equivalent contractual protections in place with our subprocessors where required by applicable data protection law.
Some third parties may act as independent controllers for their own purposes when you choose to use them (for example WhatsApp). Where that applies, we flag it below.
2. Subprocessor list (Service operations)
The table below summarises the providers we currently use. The exact data processed depends on how you use the Service, your plan, and the specific workflow (for example, identity verification is only triggered for certain actions).
| Provider | What we use them for | Typical data involved | General jurisdiction |
|---|---|---|---|
| Amazon Web Services (AWS) | Hosting, storage, infrastructure | Account data, Message content and attachments, Service logs (as applicable) | US / EU |
| Cloudflare | Security, performance, content delivery, DDoS protection | IP address and device/network data, security event data (as applicable) | Global (anycast network) |
| Render | Application hosting/managed deployment (used in certain environments) | Account data and Service data needed to run the app (as applicable) | US |
| Crunchy Data | Database hosting/management (used in certain environments) | Account data and Service data stored in the database (as applicable) | US |
| Stripe | Payment processing | Billing identifiers, subscription status, transaction data (we do not store full card details) | US |
| Twilio Ireland Limited (Twilio Inc. group) | SMS provider, used for (a) mobile-phone confirmation at the very start of every Account Holder sign-up (SMS one-time password; sign-up cannot proceed without it), and (b) Status Check escalation SMS and other transactional SMS in the operational lifecycle | Mobile phone number, verification check identifier and status, message metadata, delivery status (we do not retain the OTP itself) | EU (Ireland), some processing may transit US infrastructure depending on routing |
| Resend | Transactional email delivery (check-ins, notifications, confirmations) | Email address, message metadata, delivery status (as applicable) | US |
| Persona | Identity verification at two irreversible decision points only: (a) Delegate verification when reporting a Passing, and (b) Recipient verification when accessing a released Message with enhanced verification configured. Not engaged at Account Holder sign-up. | Identity verification flow data (processed in Persona); we receive verification outcome and limited metadata needed for audit/security | US |
| Google Ireland Limited (Google LLC group) | Google Workspace, inbound mail to info@yodo.ltd (including data subject rights requests and support correspondence) and shared Drive storage of operational documents | Email address, name, message subject and body, attachments; document files and metadata held in shared Drive | EEA primary (Dublin, Ireland); US for support routing where applicable |
| Google LLC | Identity Provider for Account Holder Google sign-in. Acts as independent controller for the authentication event; Y.O.D.O. is controller of the profile data received. Used only where the Account Holder chooses Google sign-up at the credential step. | Email, name, Google profile identifier, profile picture (where available), OAuth authorisation tokens | US |
| LinkedIn Corporation (Microsoft group) | Identity Provider for Account Holder LinkedIn sign-in. Acts as independent controller for the authentication event; Y.O.D.O. is controller of the profile data received. Used only where the Account Holder chooses LinkedIn sign-up at the credential step. | Email, name, LinkedIn profile identifier, profile picture (where available), OAuth authorisation tokens | US |
| Cookiebot by Cybot A/S | Cookie consent management, consent banner, Cookie Declaration, consent record retention (12 months) | Consent ID, IP address (truncated), consent timestamp, chosen categories, banner version | EU (Denmark) |
| Google Tag Manager / Google Analytics (optional) | Website analytics, only where enabled by consent | Device/usage data and analytics identifiers, only where you consent to non-essential cookies | US |
| ScoutAPM | Application performance monitoring | IP address, request and performance metadata, error diagnostics (as applicable) | US |
| Honeybadger | Error and exception monitoring | IP address, error and diagnostic data (as applicable) | EU region (US parent) |
| Better Stack | Uptime and log monitoring | IP address, log and diagnostic data (as applicable) | EU (data stored in EU regions) |
| GitHub | Source code hosting and development collaboration | Source code and limited operational and configuration data; not used to store Account Holder content | US |
Notes:
- Google Tag Manager / Google Analytics are used only where enabled and only where the user has given the required consent via Cookiebot.
- The Google Workspace entry (Google Ireland Limited) and the Identity Provider Google LLC entry are separate processing relationships. Google Workspace is a processor of inbound correspondence and operational documents under a Data Processing Amendment with Google Ireland Limited. The Identity Provider role is a controller-to-controller relationship for the authentication event only.
- The Partner referral programme (the tracking tags and Partner codes used to apply the 15% Partner discount, which must be used within 3 months under Schedule F) runs inside our own systems (the AWS and database providers listed above) and through Stripe at checkout. We do not bring in any new third-party processor for this. See Cookies Policy §6 (Partner referral parameters) and Terms Schedule F (Partner client discount).
- For security and privacy reasons we do not publish internal environment details (for example server names or exact regions) in this public list. International processing may occur depending on provider operations and configuration. See section 4.
3. Optional communication channel (not a subprocessor for core Service)
WhatsApp (Meta Platforms)
We may offer optional customer support via WhatsApp for convenience. If you contact us via WhatsApp, WhatsApp/Meta will process your messages under their own terms and policies and may act as an independent controller.
Important:
Do not send one-time codes, identity documents, death certificates, passwords, or payment details via WhatsApp. If we need documents, we will direct you to the secure in-app flow.
4. International transfers and safeguards
Some providers may process personal data outside the UK and/or the EEA. Where we transfer personal data internationally, we use appropriate safeguards required by applicable law (for example contractual protections such as Standard Contractual Clauses and the UK addendum, or other approved mechanisms where required).
More detail on international transfers sits in our Privacy Policy.
5. How we add or change subprocessors
We may add, replace, or remove providers where reasonably necessary to operate, secure, improve, or scale the Service.
When we add a new subprocessor or make a material change, we will update this list and the "Last Updated" date, and we will notify Account Holders by email at least 30 calendar days before the change takes effect.
For emergency changes needed to protect security, prevent fraud or address urgent availability issues, we will update this list as soon as reasonably practical and notify Account Holders without undue delay.
Customers under a Data Processing Addendum (DPA) may object to a proposed change within the notice period; the objection and resolution process is set out in the DPA.
5A. Additional sub-processors and contracted parties
In addition to the providers listed in §2, the following parties process limited data in support of the Service:
- Apple Distribution International Limited (Cork, IE; iCloud, EU region): work-device backup for the Y.O.D.O. engineering contractor (independent controller for that backup service). No client data is stored unencrypted on the local device. Transfer mechanism: UK adequacy in respect of the EEA.
- Slack Technologies, LLC (San Francisco, US): operational notifications channel for the Y.O.D.O. team (deployment status, error rates, alerts). No PII content; links only to the internal admin platform. Transfer mechanism: UK IDTA + EU SCCs.
- Engineering contractor (Lithuania): Y.O.D.O.'s contracted engineering processor under the Founder Services and IP Agreement and the Article 28 Data Processing Agreement. Listed by role only; named individually on Y.O.D.O.'s Companies House record but not on this public page. Transfer mechanism: UK adequacy in respect of the EEA.
Additional sub-processors (effective 28 June 2026)
Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; Google LLC group). Role: Google Workspace provider. Google Workspace Business Starter is used for inbound mail to the info@yodo.ltd address (including data subject rights requests, support correspondence, supplier communications and general business mail) and for shared Drive storage of Y.O.D.O. operational documents (policies, contracts working copies, internal records). Google Ireland Limited is the EEA contracting entity under the Google Workspace Data Processing Amendment. Some processing may transit US infrastructure (Google LLC) for support and routing. Transfer mechanism: UK adequacy in respect of the EEA for the EEA leg, UK IDTA and EU SCCs for any US-leg processing (incorporated by reference in Google's Workspace Data Processing Amendment and Model Contract Clauses).
6. Questions
If you have questions about our subprocessors or how your data is handled, contact: