Sub-processors

Last updated 11 October 2026 · published centrally by AKdev and shared across every app it publishes, KinopiQ included.

A sub-processor is a third party that processes personal data on our behalf. This register names them per product, with what each does, what it receives and where it processes it.

Read it alongside the Privacy Policy, which sets out the lawful bases, retention and your rights.

Everything we publish

These apply across every AKdev Ltd product and website.

Vercel

What it does: hosts and serves our websites and the web versions of our apps, and provides the traffic analytics and performance measurement embedded in the websites.
What it receives: the content of requests to our sites, including IP address, user agent and requested URL.
Where it processes: the United States, with pages served from Vercel’s global edge network.

Cloudflare

What it does: runs the API behind each app, the bot check on our forms, and the network in front of our analytics.
What it receives: every request to an app’s API, including IP address, the content you send and files you upload, in transit.
Where it processes: Cloudflare’s global network, nearest the person making the request.

PostHog

What it does: product analytics — which screens are used and how often.
What it receives: events and page views from signed-in use, tied to an account identifier. It does not receive what anyone writes into an app.
Where it processes: the European Union.

Stripe

What it does: takes payment for paid plans and keeps the billing record.
What it receives: your name, email address, billing address and payment details. Card numbers go to Stripe directly and never reach us.
Where it processes: the United Kingdom, the European Union and the United States.

Google Workspace

What it does: receives messages sent through the contact form on each of our websites.
What it receives: the name, email address, organisation and message you enter.
Where it processes: the United States and the European Union.

Sign-in providers — yours, not ours

Every app lets you sign in with Google, Apple or Microsoft if you choose to. Those are accounts you already hold with them, under their own terms; when you use one, it tells us who you are and nothing else. They are not sub-processors.

Google Fonts — not a sub-processor

Our sites set type in fonts originally distributed by Google. They are downloaded once when the site is built and served from our own domain, so a visitor’s browser never contacts Google and no request data reaches it.

Language-model providers

Crub, KinopiQ and SwingFactor each use a language model, and the entry below applies to all three. BusyWait uses none.

Anthropic, AWS and Microsoft

What they do: run the language models behind chat and recommendations in Crub, the reading of uploaded documents in KinopiQ and drafting in SwingFactor.
What they receive: the content you ask the product to read or answer about. In Crub, what you ask and the details of your garden needed to answer it. In KinopiQ, the text of a document you upload. In SwingFactor, the question being drafted and the text of its sources.
Where it goes: this content leaves AKdev when it is sent, and may be processed outside the United Kingdom.

Crub

Supabase

What it does: Crub’s database, sign-in and photo storage.
What it receives: your account, your gardens and everything recorded in them, the photographs you take and your free-trial record.
Where it processes: London, United Kingdom.

Kindwise

What it does: identifies plants, mushrooms and insects from a photograph.
What it receives: the photographs taken for an identification, and the location they were taken at when you allow it.
Where it processes: the European Union.

Pl@ntNet

What it does: identifies plants from a photograph.
What it receives: the photographs taken for an identification, without their location.
Where it processes: the European Union.

Google Maps Platform

What it does: draws the satellite view a garden is mapped over.
What it receives: the coordinates of the garden being mapped, from your browser.
Where it processes: the United States.

Postcoder

What it does: finds an address as you type it.
What it receives: the address you type and the one you choose.
Where it processes: the United Kingdom.

Open-Meteo

What it does: provides the weather for a garden.
What it receives: the garden’s coordinates, and nothing that identifies you.
Where it processes: the European Union.

Kindwise and Pl@ntNet are specialist image-recognition services. Crub also uses a language model for chat and recommendations; the providers, and what they receive, are under Language-model providers above. Care notes and calendars come from Crub’s own plant library.

KinopiQ

Supabase

What it does: KinopiQ’s database, sign-in and document storage. Text is extracted from uploaded documents inside it.
What it receives: your organisation’s workspace, its evidence, the documents you upload and your free-trial record.
Where it processes: Dublin, Ireland.

Resend

What it does: sends invitations and account email.
What it receives: the recipient’s email address and the workspace they are invited to.
Where it processes: Dublin, Ireland.

KinopiQ uses a language model to read an uploaded document and propose the requirements it is evidence for. The providers, and what they receive, are under Language-model providers above.

BusyWait

Supabase

What it does: BusyWait’s database and sign-in.
What it receives: your account, the calendar connections you make (with their credentials encrypted), the events BusyWait keeps in step and your free-trial record.
Where it processes: Dublin, Ireland.

Resend

What it does: sends account email, including the one telling you a calendar connection needs reconnecting.
What it receives: your email address, your workspace’s name and which provider needs attention.
Where it processes: Dublin, Ireland.

Your calendars — yours, not ours

BusyWait connects to calendar providers you already hold accounts with: Google Calendar, Microsoft Outlook and Apple iCloud. Those are your own services rather than ours, under their own terms. BusyWait reads from and writes to them because you asked it to. They are not sub-processors.

BusyWait uses no language model and no model of any other kind, and never will.

SwingFactor

Supabase

What it does: SwingFactor’s database, sign-in and source storage.
What it receives: your questions and everything modelled under them, the files and links in your workspace’s source library and your free-trial record.
Where it processes: London, United Kingdom.

Cloudflare Workers AI

What it does: turns uploaded documents into text SwingFactor can read.
What it receives: the content of the documents you upload.
Where it processes: Cloudflare’s global network.

Resend

What it does: sends invitations and account email.
What it receives: the recipient’s email address and the workspace they are invited to.
Where it processes: Dublin, Ireland.

SwingFactor uses a language model to draft the model of a question. The providers, and what they receive, are under Language-model providers above. Research by SwingFactor on the open web sends the question, never an uploaded document.

How this register changes

When a sub-processor is added, removed or replaced, this register is updated and its review date changes with it. It is served from one source and mirrored on every product site, so the version you are reading is the current one wherever you are reading it. Customers who want advance notice of a change can ask for it at hello@kinopiq.ai and we will keep a list.