Sub-processors
Every third party that touches customer data, what they do, where they are, and how transfers out of the UK and EEA are covered.
Version 2026-09-16 · In effect from 16 September 2026 · Last updated 16 September 2026
Published by [REGISTERED COMPANY NAME] Limited, company number [COMPANY NUMBER], registered in
England and Wales. Questions: legal@noddable.com
These are the only companies with access to data processed through Noddable. Each is engaged under a written contract no less protective than our own data processing agreement, and we remain responsible to you for what they do.
The list is deliberately short. We do not use a customer support platform, a product analytics tool, a session recorder, a CRM, an advertising network or an AI provider, and so none of them appears here.
Cloudflare, Inc.
| What they do | Hosting, content delivery, database, file storage, DNS and certificates. Everything the service runs on. |
|---|---|
| Data involved | All customer content and account data |
| Where | United Kingdom and EEA for storage; global edge network for delivery |
| Transfer safeguard | EU Standard Contractual Clauses with the UK International Data Transfer Addendum |
Stripe Payments Europe, Ltd.
| What they do | Payment processing, subscription billing and invoicing. |
|---|---|
| Data involved | Name, billing address, email, VAT number, card details. Card numbers go to Stripe directly and never reach us. |
| Where | Ireland, with group processing in the United States |
| Transfer safeguard | EU Standard Contractual Clauses with the UK Addendum. Stripe is a controller in its own right for fraud prevention. |
Cloudflare Email Service
| What they do | Sending transactional email — sign-in codes, renewal reminders, gallery notifications. |
|---|---|
| Data involved | Email address and the contents of the message |
| Where | EEA and United States |
| Transfer safeguard | Covered by the Cloudflare agreement above |
Being told about changes
We give at least 30 days' notice before adding or replacing a sub-processor. To receive those notices by email, write to privacy@noddable.com asking to be added to the list — there is no charge and we use it for nothing else.
If you object on reasonable data protection grounds within those 30 days, we will work with you to find a solution. If none is available you may terminate the affected part of the service and we will refund fees covering the period after termination. This is set out in clause 6 of the data processing agreement.