Processors
Overview
This page lists the service providers and data sources that Puck App Ltd ("Puck", "we", "us") uses to provide Puck, what each one does, and where it processes data. It forms part of our Privacy Policy and clause 7 of our Terms of Service.
The providers below fall into two roles:
- Sub-processors process Customer Data (such as call recordings, emails and CRM records) on our behalf, when we act as a processor for our customers.
- Processors process personal data about our own account holders and website visitors, for which we are the controller.
We also list data sources: business data providers that supply company and contact information. They are controllers of their own data, rather than our processors.
Every processor is bound by a written agreement with data protection obligations at least as protective as those in our Terms. None of our AI providers is permitted to use Customer Data to train its models.
Accounts that customers connect to Puck, such as Google Workspace, Microsoft 365, Zoom and CRM systems, are the customer's own services and are not listed here.
Where your data is stored
Puck's database is hosted in Ireland. Some providers are based in, or access data from, the United States. The transfer safeguard column shows how each transfer is protected.
Infrastructure
| Provider | Purpose | Data processed | Location | Transfer safeguard | Applies to |
|---|---|---|---|---|---|
| Supabase, Inc. | Database, authentication and file storage | All account data and Customer Data stored in Puck | Ireland (EU) | UK adequacy regulations (EEA); UK International Data Transfer Addendum to the EU SCCs for US support access | Account data and Customer Data |
| Vercel Inc. | Application hosting and delivery | Application traffic, request logs and data passing through the application | UK & EU | UK-US Data Bridge (Data Privacy Framework) | Account data and Customer Data |
AI models
| Provider | Purpose | Data processed | Location | Transfer safeguard | Applies to |
|---|---|---|---|---|---|
| Anthropic, PBC | AI model processing to generate summaries, drafts, briefings and agent actions | Call transcripts, emails, calendar events, CRM records, enrichment data and user instructions sent with each request | United States | UK International Data Transfer Addendum to the EU SCCs | Customer Data |
| OpenAI | AI model processing | As above | United States | UK International Data Transfer Addendum to the EU SCCs | Customer Data |
| Google LLC (Gemini API) | AI model processing (paid tier only) | As above | United States | UK-US Data Bridge (Data Privacy Framework) | Customer Data |
Call recording and transcription
| Provider | Purpose | Data processed | Location | Transfer safeguard | Applies to |
|---|---|---|---|---|---|
| Recall.ai, Inc. | Joining, recording and transcribing calls on Google Meet, Zoom and Microsoft Teams | Call audio, video, transcripts and participant names | United States | UK International Data Transfer Addendum to the EU SCCs | Customer Data |
Transactional email
| Provider | Purpose | Data processed | Location | Transfer safeguard | Applies to |
|---|---|---|---|---|---|
| Plus Five Five, Inc. (Resend) | Sending transactional emails, such as welcome and billing confirmation emails | Recipient name and email address, and the content of the email sent | United States | UK-US Data Bridge (Data Privacy Framework) | Account data |
Payments and analytics
| Provider | Purpose | Data processed | Location | Transfer safeguard | Applies to |
|---|---|---|---|---|---|
| Stripe Payments UK Ltd | Payments and billing. Stripe also acts as an independent controller for fraud prevention and regulatory compliance. | Billing name, email, address, VAT number and card details (card details are held by Stripe, not Puck) | United Kingdom, Ireland and United States | UK-US Data Bridge (Data Privacy Framework) | Account data |
| Mixpanel, Inc. | Product analytics (only with cookie consent) | Usage events, device and browser information, and account identifiers | United States | UK-US Data Bridge (Data Privacy Framework) | Account data |
| Usercentrics A/S (Cookiebot) | Cookie consent management | Consent choices, anonymised IP address and browser information | European Union | UK adequacy regulations (EEA) | Website visitors |
Data sources
| Provider | Purpose | Data processed | Location | Transfer safeguard | Applies to |
|---|---|---|---|---|---|
| People Data Labs, Inc. | Company information (and contact enrichment at a customer's request) | Company domains we look up; returns company and business contact information | United States | UK International Data Transfer Addendum to the EU SCCs | Account onboarding and Customer Data |
| Logo.dev | Company logos | Company domains | United States | No personal data transferred | Account onboarding and Customer Data |
Changes to this list
We give at least 14 days' notice before adding or replacing a sub-processor, by updating this page and emailing workspace owners. If you object on reasonable data protection grounds, contact us at help@puckapp.ai, as set out in clause 7.6 of our Terms of Service.
Contact
If you have questions about our processors or how we handle data, contact us at help@puckapp.ai.
Last updated: 2 October 2026