This is the full list of third parties that process customer data on behalf of BuiltUp Technologies Ltd. It is the list referred to in our Data Processing Addendum and in the Privacy Policy.
1. What a Sub-processor Is
When you use BuiltUp, you are the controller of the personal data in your workspace: your staff, your clients, your subcontractors. We are the processor, acting on your instructions. A sub-processor is a company we bring in to do part of that job for us, such as storing the database or delivering an email. They only get the data they need to do their part, they are bound by written terms, and we stay responsible to you for what they do.
We do not run our own data centre and we are not going to pretend otherwise. Everything below is named so you can check it against your own procurement rules before you sign anything.
2. Core Sub-processors
These are engaged for every customer. Using BuiltUp means data passes through them.
| Processor | What it does | Where it processes |
|---|---|---|
| Supabase | Hosts the PostgreSQL database holding accounts, workspaces, projects, scopes, quotes, invoices and messages. | United States |
| Amazon Web Services (S3) | File storage for drawings, specifications, site photographs, documents and exports. | United States |
| OpenAI | Document and drawing analysis (GPT-4o) and voice note transcription (Whisper). API content is not used to train models. | United States |
| Vercel | Hosting and delivery of the marketing site and the web app, including request logs. | United States, with a global edge network |
| Stripe | Card payments and subscription billing on the web. Card numbers are handled by Stripe and never reach our servers. | United States, Ireland and the United Kingdom |
| RevenueCat | Manages mobile subscription entitlements and validates App Store and Google Play receipts. | United States |
| Apple | App Store subscription billing, and Sign in with Apple where you choose to use it. | United States and Ireland |
| Google Play subscription billing, and Google sign-in where you choose to use it. | United States | |
| Resend | Delivery of transactional email: invitations, quotes and invoices sent to your clients, password resets and system notices. | United States |
3. Optional Integrations
There are two, and neither receives anything unless you connect it yourself from Settings, Billing, Integrations. If you never connect one, no data goes to it, and you can disconnect at any time. Once connected, the data you push into your own accounting organisation is governed by your agreement with that provider as well as ours. Both are one-way: BuiltUp writes client records and issued invoices across and reads nothing back.
| Processor | What it does | Where it processes |
|---|---|---|
| Xero | Client records and issued invoices pushed to your accounting organisation, if you connect it. Nothing is read back out of Xero. | New Zealand, Australia, the United States and the European Union |
| QuickBooks (Intuit) | Client records and issued invoices pushed to your company file, if you connect it. Nothing is read back out of QuickBooks. | United States |
4. International Transfers
Most of the providers above are United States companies, so customer data leaves the UK. We do not offer UK-only data residency and we will not claim it.
Those transfers are made under the UK International Data Transfer Addendum (IDTA) to the EU Standard Contractual Clauses, or under the Standard Contractual Clauses alone where the transfer is from the EU, together with the technical measures described on our security page: encryption in transit, encryption at rest and scoped access.
5. Changes and Notice
- This page is the register. It is updated whenever the list changes, and the date at the top moves with it.
- 30 days' notice. Before a new sub-processor starts handling customer data, we email account owners at least 30 days beforehand.
- You can object. Reply within those 30 days with your reasons. If we cannot resolve it, you may terminate the affected part of the service without penalty for the remainder of the term.
- Replacements. If we have to move a provider urgently, for example because one stops trading, we will tell you as soon as we can and explain what changed.
To be added to the notification list, email privacy@builtup.io with your workspace name.
6. Contact
Questions about this list
privacy@builtup.ioRegistered office
BuiltUp Technologies Ltd
Registered in England & Wales, Company No. 16100518
86-90 Paul Street, 3rd Floor
London, United Kingdom, EC2A 4NE