Last updated: 3 August 2026
These are the third parties that process personal data on our behalf to run Other Me and SCRS. We publish the list rather than supply it on request, so you can check it before you ask us anything. It forms part of our Data Processing Addendum.
| Sub-processor | What it does | Location |
|---|---|---|
| Google Cloud (Google Cloud EMEA Ltd) | Application hosting, the customer database, object storage for uploaded files, and the hardware security module that holds our encryption keys. | United Kingdom (London / europe-west2) |
All customer content at rest — database, uploaded files, backups — stays in the United Kingdom. Encryption keys are held in Google Cloud KMS and are HSM-backed.
| Sub-processor | What it does | Location |
|---|---|---|
| Mailgun (Sinch) | Sends transactional email — sign-in codes, invitations, notifications, receipts. Receives the recipient address and the message body. | European Union (EU region endpoint) |
| MailerSend | Standby email delivery. Used only when Mailgun fails or does not respond, so that a sign-in code still arrives during an outage. | European Union |
| Sub-processor | What it does | Location |
|---|---|---|
| Revolut | Takes card payments and holds saved cards for subscriptions. Card numbers go to Revolut directly and are never stored on our systems. | United Kingdom / European Union |
These receive prompts after SCRS has replaced personal data with pseudonyms. Names, addresses, account numbers and other identifiers are substituted before the request leaves our infrastructure, and the real values are restored only for the authorised user reading the answer. None of these providers train on our customers’ content.
| Sub-processor | What it does | Location |
|---|---|---|
| OpenAI | Language-model inference. | United States |
| Anthropic | Language-model inference. | United States |
| Google (Gemini API) | Language-model inference. | United States / European Union |
| xAI | Language-model inference. | United States |
SCRS Enterprise customers may bring their own model keys instead, in which case the request goes to their own provider account under their own agreement and the providers above do not receive it.
| Sub-processor | What it does | Location |
|---|---|---|
| hCaptcha (Intuition Machines) | Blocks automated sign-ups. Receives the visitor’s IP address and browser characteristics on the sign-up and sign-in pages only. | United States |
If you connect a third-party account yourself — GitHub, Calendly, Notion, HubSpot, Jira, Zoom, Airtable, Pipedrive, DocuSign or QuickBooks — you are directing that transfer, and that service is your processor rather than ours. We pass only what the connection you authorised requires. You can disconnect any of them at any time from Settings, which stops the transfer immediately.
We do not use advertising networks, data brokers or analytics providers that receive customer content.
Customer content is stored in the United Kingdom. Where a sub-processor is outside the UK / EEA — the AI providers in section 4 and hCaptcha in section 5 — the transfer is made under the UK International Data Transfer Addendum or the EU Standard Contractual Clauses, and, for the AI providers, only after pseudonymisation.
We update this page when a sub-processor is added or removed, and the date at the top changes with it. Customers under a Data Processing Addendum receive notice of additions with a right to object. To be told by email when this page changes, write to privacy@pophastalabs.com.
privacy@pophastalabs.com · Pop Hasta Labs Ltd, a company registered in England and Wales (no. 16742039), registered office 128 City Road, London EC1V 2NX, United Kingdom. See also our Privacy Policy and Data Processing Addendum.
