LEGAL
Sub-processors
The third-party providers that process personal data for Project Alix, and the safeguards that apply.
Project Alix uses a small number of trusted service providers (“sub-processors”) to run our infrastructure and deliver Walk & Talk, the Alix dashboard and projectalix.com. Only services that process personal data belonging to end users, housing-association clients or WhatTheMould users are listed here. Last updated 29 September 2026.
Core sub-processors
Google Cloud (Europe) — Production infrastructure (compute, storage). Region: Europe. Google Cloud Data Processing Addendum.
Supabase (Europe) — Production database, authentication and storage. Region: EU. Supabase Data Processing Addendum.
OpenAI (United States) — Large language model inference: turns on-device transcripts into structured report content, and analyses damp and mould photos. Region: US. Transfer covered by the UK IDTA / EU SCCs plus a Transfer Risk Assessment. OpenAI Data Processing Addendum.
Anthropic (United States) — Large language model inference for report generation, used in parallel with OpenAI. Region: US. Transfer covered by SCCs. Anthropic Data Processing Addendum.
Resend — Transactional email delivery (reports, letters, reminders, notifications). Resend Data Processing Addendum.
Mixpanel EU (Europe) — Product analytics (pseudonymous events tied to your account, scoped per app). Region: EU.
Twilio (United Kingdom / Europe) — SMS and WhatsApp messaging (optional reminders). Region: UK / EU.
Sentry — Error and exception tracking. Sentry Data Processing Addendum.
Firebase Crashlytics (United States) — Mobile crash reporting. Region: US. Transfer covered by SCCs.
Microsoft Graph — Filing Walk and Talk reports to a housing association’s SharePoint tenant (Walk and Talk only). Region: the client’s tenant region.
Google Workspace (Europe) — Alix staff email, drive and calendar. Region: EU.
Namecheap (United States) — DNS and domain management (no end-user personal data). Region: US.
On-device (not sub-processors)
Speech-to-text runs on your device — Apple Speech Recognition on iPhone, and an on-device model (Sherpa-ONNX) on Android. Your voice is not sent to an external transcription provider.
International transfers
Where personal data is transferred outside the UK (OpenAI, Anthropic, Firebase Crashlytics, Namecheap) we rely on the UK International Data Transfer Agreement or the EU Standard Contractual Clauses as recognised by the UK, together with a Transfer Risk Assessment for each provider.
Changes and contact
Where we add a new sub-processor that will process personal data, we update this list and — for housing-association clients — give at least 30 days notice under our Data Processing Agreement. Questions about this list: ask@projectalix.com