Sub-processors

Last updated 1 October 2026 · To be notified of changes, email hello@narrasight.com

OpenAI

Purpose: large language model inference (vision) to generate alt text from submitted images and page context.
Data involved: image content and prompt context, which may incidentally contain personal data.
Location: United States, under OpenAI's API terms for UK customers.
Transfer mechanism: the UK-US Data Bridge where OpenAI's certification applies, otherwise the UK IDTA/Addendum with a transfer risk assessment.
Note: contracted on API/business terms under which OpenAI does not train on submitted data.

Purpose: application hosting and compute.
Data involved: data in transit through the app and transiently in memory.
Location: London (LHR) region for processing. Fly.io's platform operations and support may access infrastructure from outside the UK under its standard terms.

Purpose: PostgreSQL storage of descriptions, usage events and account data, plus authentication.
Data involved: stored descriptions (may contain personal data), account data, usage logs.
Location: West EU (Ireland) region. Transfers from the UK rely on the UK's adequacy regulations for the EEA.

Purpose: Redis for idempotency keys, rate limiting and job queueing.
Data involved: identifiers, counters and short-lived keys only, and no descriptions, images or account content are stored here.
Location: a single Upstash region selected at setup, and the data held is transient and contains no substantive personal data.

Purpose: payment processing and subscription billing (card data handled by Stripe, not stored by NarraSight).
Data involved: billing contact and payment details.
Location: Stripe processes payments globally under its own data processing terms and transfer safeguards, and card data never touches NarraSight's systems.

Purpose: static hosting for narrasight.com and app.narrasight.com.
Data involved: the site's own static files, plus the request details any web server receives (IP address, browser user agent and the address requested). No form submission passes through Netlify.
Location: Netlify serves the website from its global content delivery network, so pages may be served from outside the UK.
Transfer mechanism: Netlify's Data Processing Agreement, which incorporates the standard contractual clauses with the UK International Data Transfer Addendum.

Purpose: large language model inference to write the website reports and follow-up emails we send, and to check each draft before it is sent.
Data involved: text and image context taken from the public pages of the website being reviewed, and the draft email text. Email addresses are not sent to the model.
Location: the Azure account is in the UK South region, but the model deployments use Microsoft's Global Standard deployment type, which is not tied to one region, so requests may be processed outside the UK.
Transfer mechanism: the Microsoft Products and Services Data Protection Addendum, which covers any transfer outside the UK.

Purpose: sending our emails, including website reports, follow-ups, form acknowledgements and an internal daily summary.
Data involved: recipient email address, message subject and body (which includes our findings about the recipient's website) and sending metadata. Open and click tracking is switched off.
Location: the service's data location is set to the UK, for the service and for both sending domains. The resource itself is registered by Microsoft as global.
Transfer mechanism: the Microsoft Products and Services Data Protection Addendum, which covers any transfer outside the UK.

Purpose: the record of the form and report service: form submissions, one record per person per website contacted, every report as sent, send failures and the work queue.
Data involved: email addresses (held as a hashed key in the main record, and in clear in form and send-failure records), the websites scanned and the full text of every email sent.
Location: UK South region, locally redundant storage with no copy held in a second region.
Transfer mechanism: the Microsoft Products and Services Data Protection Addendum, which covers any transfer outside the UK.

Purpose: runs the form and report service: the endpoint the Health Score and enquiry forms post to, the scanning and report worker, and the unsubscribe page.
Data involved: the data held in Azure Storage, in transit and transiently in memory, plus application logs.
Location: UK South region. Application logs are held in a Log Analytics workspace, also in UK South.
Transfer mechanism: the Microsoft Products and Services Data Protection Addendum, which covers any transfer outside the UK.