Service Providers and Other Recipients

Version 7Effective 5 Nov 2026

This page describes the main services supporting the website, free Snapshots, accounts and partner portal. A provider receives information relevant to its function, not automatically every record we hold. Our Privacy Notice explains purposes, retention, rights and international processing.

ProviderVercel

Function

Website hosting and server functions

Information involved

Requested page addresses, IP addresses, browser headers and information passing through server functions.

ProviderSupabase

Function

Database, authentication and file storage

Information involved

Account, report, enquiry and partner records, sign-in information and authorised files stored for the service.

ProviderOpenAI

Function

Snapshot research, assessment ratings, writing and chat routing

Information involved

Structured business context and public material for standard Snapshots; the current filtered chat question for chat. The Privacy Notice describes what is excluded and the remaining identification risk.

ProviderResend

Function

Email delivery

Information involved

Recipient address, subject and message content, which can include requested report details, plus delivery metadata and logs.

ProviderCloudflare Turnstile

Function

Bot detection and protection of forms

Information involved

IP address, TLS fingerprint, user-agent header, sitekey and associated origin, and verification tokens. Cloudflare acts as our processor for the bot check and as an independent controller when improving its bot-detection capabilities.

ProviderSentry

Function

Error monitoring and fault diagnosis

Information involved

Error and diagnostic information, including application environment and release details. We limit diagnostic collection to what is needed to investigate faults.

ProviderMicrosoft (Clarity), as an independent controller

Function

Website session insights on informational pages, with analytics consent only

Information involved

Clicks, scrolling and page movement; page addresses; device, browser and screen information; approximate location derived from IP address; and a random Clarity identifier. Input-field contents and the assistant chat are masked; page layout and interaction events remain visible. Microsoft acts as an independent controller under the Microsoft Privacy Statement, not as our processor. Its terms permit uses including service improvement and advertising profiling; we send advertising-storage consent as denied. Microsoft may process data in the United States and other countries.

Anthropic (used only when written chat answers are switched on): Anthropic PBC writes chat answers from our published website pages when our stored answers do not cover a question. It receives the current chat question and up to three earlier turns of the same chat, with email addresses and phone numbers removed, and the published passages used.

Infrastructure and access can involve Germany, the United States and other countries:

Vercel: Functions default to the US region (iad1) unless another region is configured. Our selected region for the functions supporting this service is Frankfurt (fra1). Routing Middleware and distributed delivery can operate across Vercel’s global regions. Vercel’s DPA identifies the United States as its primary processing location, and Vercel’s Terms incorporate the DPA for Pro customers; our plan is Pro. Selecting Frankfurt does not confine all Vercel processing to Germany.

Supabase: The contracting entity is Supabase Pte. Ltd., Singapore. Our selected primary database region is Frankfurt (eu-central-1). Core database data and backups stay in the selected region. Customer account information, support requests, usage information and any configured content delivery (CDN) may involve processing outside that region.

OpenAI: OpenAI processes API data in the United States and other locations it uses; we have not selected a regional data-residency option.

Anthropic: Anthropic PBC is based in the United States. Chat questions sent to it may be processed in the United States and other countries.

Resend: Account data, message content, delivery metadata and logs are stored in the United States, regardless of the sending region. Resend keeps message content and logs for 30 days, and backups for up to 7 days.

Cloudflare: Processing uses its global network. Its Turnstile Privacy Addendum explains its separate processor and controller purposes.

Cloudflare R2: We keep a daily backup copy of files uploaded to the service in a private Cloudflare R2 storage bucket in the EU jurisdiction. It is used only to restore lost or damaged files and is kept under our backup retention cycle.

GitHub: Our scheduled backup job runs on GitHub Actions. The job processes uploaded files only while copying them to the backup and does not keep them afterwards.

Contact our privacy lead for current information relevant to your data.

Communications and professional services

Our business email service handles correspondence. Specialist calls take place on a video-call service, and booking invitations are sent by email. Where an assignment requires another document or payment service, we explain the relevant processing before collecting data through it and update the applicable information.

Independent professional firms receive information following the introduction or package-engagement process described in our Privacy Notice. A package can involve ExpandUs engaging and paying a firm as principal; payment arrangements do not by themselves determine the firm’s data-protection role. They normally act as separate controllers for professional advice, client checks and regulatory duties. Authorities, advisers and other recipients may also receive information in the limited circumstances explained there.

We assess required provider agreements and transfer arrangements before authorising relevant processing. This page is a description of recipients, not a representation that every possible transfer uses the same contractual mechanism. We update it when material service arrangements change. Contact privacy@expandusglobal.com, with hello@expandusglobal.com as a fallback, for questions about a provider or the safeguards relevant to your information.