Legal
Subprocessors
Last Updated: 6 October 2026
How to read this page
A subprocessor is an organisation that handles personal information on LaceLink's instructions, so that LaceLink can provide the service. The list below is taken from the services the LaceLink apps and website actually call.
Some organisations also decide their own purposes for information they receive. Those are listed separately. They are not described as LaceLink subprocessors for everything they do.
We have not stored a signed UK transfer contract for these suppliers in this project. Where a supplier may handle information outside the United Kingdom, that is noted below. Their own privacy policy explains their practices.
Subprocessors
Supabase
- Purpose: Database, sign-in, file storage, and the server functions that send email and push alerts.
- Information involved: LaceLink account information and Client Data a seamstress or boutique stores, including photographs and messages.
- Location: The LaceLink project is hosted in Supabase's London region. Supabase is a US company, so staff or support access may happen outside the United Kingdom.
- Their privacy policy: supabase.com/privacy
Resend
- Purpose: Sends appointment, booking, and account emails that LaceLink asks it to send.
- Information involved: Names, email addresses, and the content of those messages, which can include appointment details.
- Location: Resend is a US company. Sending email may involve processing outside the United Kingdom.
- Their privacy policy: resend.com/legal/privacy-policy
Expo
- Purpose: Delivers push alerts from the LaceLink app.
- Information involved: A device push token, and the title and text of the notification.
- Location: The app sends this to Expo's push service. Expo is a US company. Expo then delivers the alert to Apple on iPhone and iPad, and to Google on Android.
- Their privacy policy: expo.dev/privacy
Vercel
- Purpose: Hosts the public website at lacelink.co.uk.
- Information involved: Ordinary connection information for a visit, such as an IP address. Public profile pages also read studio information from Supabase.
- Location: Vercel is a US company. The hosting region used for LaceLink, and any transfer contract, are not recorded in this project.
- Their privacy policy: vercel.com/legal/privacy-policy
Service providers and other third parties
Stripe
- Purpose: Handles a card payment when a seamstress or boutique connects Stripe and a client pays an invoice by card.
- Information involved: LaceLink stores the payment result, such as status, amount, and Stripe identifiers. LaceLink does not store the full card number.
- Location: Stripe may act as its own controller for the card payment, rather than only on LaceLink's instructions. Stripe is not listed here as a LaceLink subprocessor for everything it does with a payment. Stripe's own privacy policy applies.
- Their privacy policy: stripe.com/privacy
- Purpose: Place search, the map, directions, and review snippets when a professional pins a Google listing on their public profile.
- Information involved: The place search the professional types, and the Google listing shown on the public page. Google is not used to store a bride's measurements.
- Location: Google handles this under its own privacy policy. Google is not a LaceLink subprocessor for Client Data.
- Their privacy policy: policies.google.com/privacy
Apple
- Purpose: Distributes the iPhone and iPad app, and delivers notifications to those devices after Expo sends them.
- Information involved: Apple handles App Store accounts under its own terms. Notification delivery uses the device token already described under Expo.
- Location: Apple is not described as a LaceLink subprocessor for Client Data.
- Their privacy policy: apple.com/legal/privacy