Sub-processors

Tuppin uses a small number of service providers to run the service. Where those providers handle personal data on your behalf, they are sub-processors under Article 28 of the UK GDPR, and this page lists them.

Our Data Processing Agreement explains the arrangement. In short: you authorise us to use these providers, we hold each of them to obligations no less protective than those we owe you, and we remain responsible to you for what they do.

We keep this page current. Section 3 explains how we tell you about changes and what to do if you object to one.

1. Current sub-processors

Provider	What they do for us	Personal data involved	Where it is processed
Neon Inc.	Hosts the database holding your account and bookkeeping records	All data you enter, including anything you record about your customers and suppliers	United Kingdom
Vercel Inc.	Hosts and serves the application, and provides cookieless page-view analytics	IP address, device and browser information, pages visited	United Kingdom (London region) for the application; United States for Vercel's platform logs and support, under the UK International Data Transfer Addendum
Sendinblue SAS, trading as Brevo	Sends transactional email, including sign-in links and service notices	Email address, message content, delivery status	European Union (France, Germany and Belgium)
Cloudflare, Inc.	DNS, and routing of inbound email to our addresses	DNS query metadata, and the content of emails sent to us	Global anycast network. Cloudflare is US-incorporated; transfers rely on its certification under the UK–US data bridge, with Standard Contractual Clauses and the UK Addendum as a fallback

2. Not sub-processors

Some services we use are not sub-processors, so they are not listed above:

• Stripe, our payment processor, takes payment for your Tuppin subscription once paid plans start. It handles your billing details as our customer, for which we are the controller under our Privacy Policy, and never receives the records you keep in Tuppin. We contract with Stripe Payments Europe, Limited, and with Stripe Payments UK Ltd where Stripe's financial services terms apply.
• HMRC is not a sub-processor. If you submit figures to HMRC through Tuppin, HMRC receives them as a public authority in its own right, not on our behalf.
• Our own tools — code hosting, issue tracking, the accounting software we use for our own books — hold no customer personal data.
• Domain registration and certificate providers handle no personal data belonging to you or the people you trade with.

If you think something belongs on this list that isn't here, email legal@tuppin.uk and we will look into it.

3. Changes and objections

Before we add or replace a sub-processor, we will email you at least 30 days beforehand and update this page. Where a provider has to be replaced urgently — after a security incident or a provider failure, say — we will give notice as soon as we reasonably can.

If you object on reasonable data protection grounds, tell us within 14 days of the notice at legal@tuppin.uk. We will work with you to find a solution. If we cannot, you may close your account without penalty and we will refund a pro-rata share of any prepaid fees.

This mirrors clause 6 of the Data Processing Agreement, which is the binding version if the two ever differ.

To be told about changes, no subscription is needed: notices go to the email address on your account.

4. Change log

Date	Change
9 October 2026	First published.
10 October 2026	Stripe, listed as to be confirmed, confirmed as not a sub-processor and moved to section 2.

We add a row here whenever a provider is added, removed or replaced, so you can see the history rather than only the current position.