← kinesthetics.io · Privacy notice · Sub-processors
Archez Ltd Trading as Kinesthetics
| Effective date | 14 June 2026 |
|---|---|
| Version | 1.1 (1 November 2026) |
This document lists the third-party sub-processors that Archez Ltd uses to deliver its products and services (Kin Analytics, the Kinesthetic learning platform, and the websites we operate). It is maintained in line with our Article 28 UK GDPR obligations and is referenced from our Privacy Notice, ROPA and Terms of Service.
We update this list when we add, replace or remove a sub-processor. Current and historic versions are available on request.
Since October 2026 our primary database runs on Archez-controlled servers in the United Kingdom. Those servers are ours and are not a sub-processor.
| Provider | Role | Personal data processed | Location | Transfer mechanism | Article 28 terms |
|---|---|---|---|---|---|
| Supabase, Inc. | Primary database, file storage, edge compute, authentication, row-level security | User account data; intelligence records (containing the limited personal data described in our Privacy Notice section 6); audit logs | Database hosted in United Kingdom (eu-west-2); company headquartered in the United States | UK adequacy for hosting region; IDTA / UK Addendum for any corporate-level data access in the US | Supabase DPA |
| Netlify, Inc. | Frontend hosting, CDN | No personal data of subjects of intelligence; minimal request metadata (IP, user agent) only at the CDN edge for delivery and DDoS protection | Global CDN, USA headquarters | UK Addendum to EU SCCs | Netlify DPA |
| Provider | Role | Personal data processed | Location | Transfer mechanism | Article 28 terms |
|---|---|---|---|---|---|
| OpenAI, L.L.C. | AI-assisted research over the public web; structured extraction from public-source results | The output text containing the categories of data described in the Privacy Notice section 6, processed in transit | United States | UK Addendum to EU SCCs; OpenAI's published international data transfer commitments | OpenAI Data Processing Addendum. Under OpenAI's default API terms (in force since 1 March 2023), data submitted via the API is not used to train or improve OpenAI models. Request and response data is retained for up to 30 days for abuse monitoring before deletion |
These are upstream sources we read from. They are not our processors and we are not theirs. We list them here for transparency.
| Source | Role | Notes |
|---|---|---|
| Companies House (UK Government) | UK statutory public companies register | Public sector data made available under the Open Government Licence. No personal data of ours is sent to Companies House beyond the query parameters |
| Google News (RSS index) | Index of public news publications | Public RSS feed. No personal data of ours is sent beyond the search query |
| Google Maps Platform — Street View Static API | Building exterior photograph for the registered office of a company under analysis | Queries are address-level; no personal data of any individual is sent |
| Provider | Role | Personal data processed | Location | Transfer mechanism | Article 28 terms |
|---|---|---|---|---|---|
| Email delivery provider | Transactional and notification emails to our users and prospects | Recipient name and email, message content | TBC | TBC | TBC |
| Payment processor | Subscription billing, invoicing, payment card processing | Name, billing address, VAT, payment card data (processed entirely by the provider, never by Archez) | TBC | TBC | TBC |
The two TBC entries will be populated when those services go live and customers will be notified before any new sub-processor begins processing.
The vendors listed below are not sub-processors in the Article 28 UK GDPR sense — they do not process personal data of our users or subjects of intelligence on our behalf. They are listed here because enterprise procurement teams typically ask about insurance and crisis-response vendors.
| Provider | Role | Details |
|---|---|---|
| Hiscox Insurance Company Limited | Professional indemnity insurance covering claims arising from our professional services as a technology / SaaS provider | Policy PL-PSC10003951476/00. £1,000,000 aggregate limit. Worldwide cover (excluding US and Canadian courts). Hiscox is authorised by the Prudential Regulation Authority and regulated by the Financial Conduct Authority and the Prudential Regulation Authority |
| Hill & Knowlton Strategies Ltd | 24-hour crisis containment and crisis communications provider, made available through the Hiscox Crisis Containment cover | £25,000 limit per crisis. UK, Isle of Man, Channel Islands and Republic of Ireland |
We will give notice of the addition of any new sub-processor that processes personal data, or of a change of an existing sub-processor, before the new arrangement takes effect, where reasonably practicable, and in any case promptly afterwards. Notification is by:
(a) email to the primary contact of every active subscriber, where the change concerns Group A (user) data; (b) update of this document and a dated changelog at the bottom of this page, where the change concerns Group B (intelligence) data.
If a subscriber objects to a new sub-processor on documented data-protection grounds within 30 days of notification, we will discuss alternative arrangements in good faith. If no acceptable arrangement is reached the subscriber may terminate the affected service without penalty for the remainder of the then-current Subscription Term.
Before engaging a sub-processor we require:
We periodically reassess each sub-processor's continued suitability.
| contact@kinesthetics.io | |
|---|---|
| ICO registration | Registered with the Information Commissioner's Office |
| Companies House | 17151326 |
| Date | Change |
|---|---|
| 14 June 2026 | Initial publication |
| 1 November 2026 | Primary database moved to Archez-controlled servers in the UK |
Archez Ltd · company 17151326 · Registered with the ICO · contact@kinesthetics.io