TradeFloThe list
We use these companies to run the site and the tools. Some only apply when you use one tool or accept analytics. We built this list from the services the live site calls, and each data location from the company's own published terms.
| Company | Purpose | Data it handles | Data location and transfers | When it applies | Its terms |
|---|---|---|---|---|---|
| Vercel | Hosts the website and its server code. | Visitor IP addresses and request logs. | United States: our server code runs in Washington, D.C. Covered by the EU-US Data Privacy Framework. | Every visit. | Data processing terms (opens in a new tab) |
| Supabase | Holds our database and runs some server functions. | Client details, enquiries, check and audit submissions and results. | Ireland: our database region. Standard contractual clauses in its terms cover any access from outside the EU. | When you submit a form or a check, or are a client. | Data processing terms (opens in a new tab) |
| PostHog | Measures how visitors use the site, including masked session replays. | Page views, clicks and device type. Typed form text is masked. | Frankfurt, Germany: PostHog's EU cloud. Covered by the EU-US Data Privacy Framework for any access from the US. | Only if you accept analytics on the cookie banner. | Data processing terms (opens in a new tab) |
| Resend | Sends service emails such as enquiry alerts and report links. | Recipient email address and message content. | United States. Standard contractual clauses in its terms. | When we email you about a check or an enquiry. | Data processing terms (opens in a new tab) |
| Anthropic | Provides AI tools that read and summarise a website scan, and one of the AI assistants the AI mention check asks. | The business name, trade, area and web address you enter, and the public pages of that site. | United States, and its AI may run in other countries. Standard contractual clauses in its terms. | When you run the website check or the AI mention check. | Privacy policy (opens in a new tab) |
| Perplexity | Provides an AI search tool that the AI mention check asks. | The business name, trade and town or area you enter. | Not published, so we treat it as outside the EU. Standard contractual clauses in its terms. | When you run the AI mention check. | Privacy policy (opens in a new tab) |
| Provides business profile data, page speed results and an AI tool used by the AI mention check. | The business name, town or area, or web address you enter. | United States and the other countries where Google has facilities. Covered by the EU-US Data Privacy Framework. | When you run the Google profile check, the site speed check or the AI mention check. | Privacy policy (opens in a new tab) | |
| Upstash | Counts requests so we can stop abuse of our tools. | Hashed IP addresses and request counts. | Ireland: the region of our database. Covered by the EU-US Data Privacy Framework for any access from the US. | When you use a tool. | Data processing terms (opens in a new tab) |
Each company handles personal data under a data processing agreement with us. Where it stores or reaches data outside the EU or the UK, the safeguards in our privacy notice apply.
When this list changes
We update this page when we add or remove a company. Clients get an email at least 30 days before a new company starts handling their data, as set out in the data processing addendum.