Skip to content

Sub-processors

Last updated 21 September 2026

Changes. We add a new sub-processor at least 30 days after listing it here, with the date it was listed. We do not email anyone about changes yet, so check this page, or ask us to tell you by writing to dev@refact.co. The data processing agreement says how to object.

Sub-processors

These process personal data on your site, or in your conversations with your agent, on our behalf. We are liable to you for how each of them performs.

  • Anthropic (Anthropic, PBC), United States. The AI model behind the agent. Data: Instructions, and the parts of the site needed to carry them out, which can include personal data on the site. Transfer basis: Standard contractual clauses (modules two and three) and the UK addendum, in Anthropic's data processing addendum. Listed since 21 September 2026.
  • DigitalOcean (DigitalOcean, LLC), United States (New York). The servers the agent and its activity log run on, and where your agent's backups taken before 24 September 2026 are kept. Data: Everything the service holds, including your agent's backups taken before 24 September 2026, which are copies of the site's database. Transfer basis: EU-US Data Privacy Framework and its UK extension, with standard contractual clauses as a fallback. Listed since 21 September 2026.
  • Netlify (Netlify, Inc.), United States. Hosts the SiteSelf website and dashboard. Data: What the dashboard shows, including the activity log, as it passes through. Transfer basis: Not yet verified against Netlify's terms. Listed since 21 September 2026.

Processors for our own data

These process only our own data about you, such as your account, billing or visits to this website.

  • Resend (Plus Five Five, Inc.), United States. Sends account emails. Data: Account email addresses and the content of those emails. Transfer basis: Not yet verified against Resend's terms. Listed since 21 September 2026.
  • Stripe (Stripe, Inc.), United States. Payments and subscription management. Data: Billing details. Card numbers go to Stripe and never reach us. Transfer basis: EU-US Data Privacy Framework and standard contractual clauses, in Stripe's data transfers addendum. Listed since 21 September 2026.
  • Google Analytics (Google LLC), United States. Counts visits to the SiteSelf website. Data: Pages visited and signup and sign-in events. Never email addresses, passwords, site addresses or conversations. Transfer basis: Not yet verified against Google's terms. Listed since 21 September 2026.

The chat app you use

These are not our processors. Your messages to your agent pass through whichever you choose.

  • Telegram. Runs its own service under its own privacy terms. Messages to a bot are not end-to-end encrypted, so Telegram can read them.
  • Slack. Your workspace is your own agreement with Slack, and your messages to your agent pass through it under those terms.

Running sites for clients? This notice is written for you to forward to them.