Subprocessors
The providers that process personal data on our behalf, what each one does and where they do it.
Last updated: · version 2026-08-01
1. What this page is
To run SocialPostxr, ACEMAN SOFTWARE SOLUTIONS LTD uses third-party providers for hosting, storage, publishing, payments, email, monitoring and AI generation. Where those providers handle personal data on our behalf, they are our processors, and because you are our customer they are your subprocessors.
This page is the authoritative list. Our Data Processing Agreement incorporates it by reference, so it is a contractual document, not just a courtesy.
A provider is listed here when personal data actually reaches it — not merely because we hold an account with them. We would rather this list be exactly right than merely long.
2. The register
| Provider | Purpose | Data processed | Lawful basis | Retention | Location & safeguard |
|---|---|---|---|---|---|
| Salesforce, Inc.Heroku | Application hosting | Everything the backend processes in transit: account identifiers, email addresses, brand descriptions, uploaded images, post text | Contract — Art. 6(1)(b) | Ephemeral; logs held only in a rolling buffer | EUUK→EEA, none required |
| Supabase, Inc. | Database, object storage, authentication, realtime | The whole user record: identifiers, email, names, brand profiles, uploaded and generated images and video, post content, schedules, credit ledger | Contract — Art. 6(1)(b) | Controlled by us for live rows | United Kingdom (London, eu-west-2)UK/EEA — none required (data at rest is in the UK) |
| Cloudflare, Inc. | Hosting this site; CDN, TLS, WAF and bot management in front of the API | Site visitors: IP address, user agent, request URL, bot-management cookie | Contract — Art. 6(1)(b); Legitimate interests — Art. 6(1)(f)Our interest: Keeping the site and the API available and protected from attack, bots and abuse. | Bot cookie 30 minutes | Global edge, nearest locationUK Addendum |
| Google Ireland LimitedFirebase Hosting | Hosting the web application | App visitors: IP address, user agent, requested path | Contract — Art. 6(1)(b) | — | europe-west1, global CDN edgeUK→EEA none required for the backend; UK Addendum for edge |
| Google LLCGoogle Fonts | Font delivery for the SocialPostxr app (web and mobile) — not this website. The app loads font stylesheets from fonts.googleapis.com and font files from fonts.gstatic.com. This website serves every font from our own servers and sends nothing to Google. | Your device's IP address and technical request data (user agent, which font files were requested), sent directly from your device to Google whenever the app loads fonts. That is every app session, because the app's text engine also loads its fallback fonts from Google — not only when you choose a font in the font picker. No account identifier is sent, and Google states these requests are not linked to a Google account or used for profiling. | Contract — Art. 6(1)(b) | Google-controlled; per Google's Fonts privacy statement, requests are logged in aggregate | United States / globalNecessary for the font feature the user operates, disclosed at signup (UK GDPR Art. 49(1)(b)); no contractual safeguard exists for this service |
| OpenAI | Generating post copy, art direction, campaign strategy, image description and image generation | Brand names and descriptions, tone and visual-identity text, target-audience descriptions, campaign briefs, questionnaire answers, uploaded and generated images sent for analysis, the website address given for brand extraction. No account email is sent. | Contract — Art. 6(1)(b) | Not used for training. Abuse-monitoring logs up to 30 days | United StatesUK Addendum |
| Ayrshare LLC | Publishing to the user's connected social accounts and retrieving analytics | Post text, hashtags, media, scheduled times; connected social account authorisations; returned analytics, comments and messages | Contract — Art. 6(1)(b) | Life of the account; deletion acknowledged within five business days | United StatesUK Addendum |
| Stripe | Subscription billing and checkout | Email address, Stripe customer identifier, account identifier in checkout metadata. Card details go directly to Stripe and never reach us. | Contract — Art. 6(1)(b) | Regulatory retention periods | United States / United KingdomUK Addendum |
| Microsoft Ireland Operations Limited | Sending transactional and support email | Recipient email address, and the subject and body of transactional support email — whatever the user typed into the support form | Legitimate interests — Art. 6(1)(f)Our interest: Replying to you when you contact us for support. We cannot answer a support request without sending you an email. | Controlled by our mailbox settings | European UnionUK/EEA — none required |
| Functional Software, Inc.Sentry | Error monitoring and service reliability | Exception type, message and stack trace; a pseudonymous account identifier. Request bodies, cookies and authentication headers are not sent. | Legitimate interests — Art. 6(1)(f)Our interest: Being told when the service breaks, with enough detail to fix it, rather than waiting for someone to report it. | 90 days | EU — GermanyUK→EEA none required; UK Addendum for onward US processing |
| Grafana Labs | Performance monitoring | Performance traces of outbound requests: method, URL, status, timing. URLs contain a pseudonymous account identifier. No request or response bodies. | Legitimate interests — Art. 6(1)(f)Our interest: Knowing which parts of the service are slow, so we can keep it usable. | 30 days | United KingdomNone required |
| Google Ireland LimitedGoogle Analytics | Website and product analytics | Visitors who accept analytics cookies: IP address, device and browser data, pages viewed, analytics identifier. Nothing is sent before consent | Consent — Art. 6(1)(a) | Event-level data: 2 months; user-level data: 14 months (GA4 property 523407750) | United States / globalUK Addendum |
| Google LLCGoogle Tag Manager | Delivery mechanism for analytics | Delivers the analytics script to consenting visitors; receives IP address and user agent as a consequence | Consent — Art. 6(1)(a) | Not a storage endpoint | United States / globalUK Addendum |
| Kloudend, Inc.ipapi.co | Detecting country and currency to set up the account | The user's IP address at signup, if they consent to automatic location detection | Consent — Art. 6(1)(a) | Server log files, period not published | United StatesUK Addendum |
We also maintain a fuller register internally, which includes providers that are configured in our systems but that currently receive no personal data. Only the providers that actually receive personal data are published above. We update this notice whenever that changes.
Register last verified against production: 1 August 2026.
3. Contracts and international transfers
Every provider we engage to process data on our behalf is under a written contract meeting Article 28 of the UK GDPR. They may act only on our documented instructions, must keep the data secure, must impose the same obligations on anyone they engage, and must delete or return the data when we stop using them.
One entry on this list is not one of those, and we would rather flag it than let the sentence above imply otherwise. Google Fonts is a free public service used by the SocialPostxr app. There is no contract to sign and Google offers no data processing agreement for it, so it is a recipient of personal data rather than a processor we have engaged. It is listed here because it receives your IP address and you are entitled to know that — not because we hold a contract with it.
For the same reason there is no transfer instrument to name. We rely on Article 49(1)(b) of the UK GDPR: the transfer is necessary to provide the font feature the user operates, and it is disclosed at signup. That is a narrower footing than the agreements covering every other row, and we are taking further advice on it.
This concerns the app only. This website serves every font from our own servers and sends nothing to Google.
Where a recipient is outside the UK and is not covered by UK adequacy regulations, we rely on the UK International Data Transfer Agreement, or on the UK Addendum to the EU Standard Contractual Clauses where that is the instrument the recipient offers. We do not rely on the EU Standard Contractual Clauses on their own, because they are not a valid transfer mechanism for a UK exporter.
In short, and for every row but the one above: UK International Data Transfer Agreement (IDTA) / UK Addendum. You can ask us for a copy of the safeguards relied on for any particular provider — email privacy@socialpostxr.com.
4. Changes to this list
We will give at least 30 days' notice before adding or replacing a subprocessor. If you object on reasonable data protection grounds, we will work with you to find a solution; if we cannot, you may terminate the affected part of the service without penalty.
To be told when this list changes, email privacy@socialpostxr.com and ask to be added to the subprocessor notification list.