Sub-processors
This page lists the sub-processors engaged by HOIBOY AI LTD (UK Companies House 17211412) across the hoiboy.uk AI consultancy. It mirrors the source-of-truth Annex 2 of the Data Processing Agreement (DPA) Schedule attached to the Master Services Agreement (MSA) and to each Statement of Work (SOW) signed under it.
When a sub-processor is added or replaced, affected clients are emailed the change with an effective-date at least 30 days out. Clients may object on reasonable grounds within those 30 days; an unresolved objection means the affected SOW may be terminated with pro-rata refund per SOW §5.
Current sub-processors
| Vendor | Service | Categories of data processed | Location of processing | Transfer mechanism (UK to data location) | DPA link | Last-verified date |
|---|---|---|---|---|---|---|
| Anthropic (Anthropic, PBC) | Claude API for transcript review and 8-section summarisation | Operator-redacted transcripts, summarisation prompts | US (Anthropic primary) | DPF + UK Extension (verify at https://www.dataprivacyframework.gov/list at engagement start); SCCs + UK IDTA + TRA fallback | https://www.anthropic.com/legal/commercial-terms (DPA available on request via sales) | 2026-05-09 |
| Google (Google LLC / Google Ireland Limited via Google Workspace EU instance) | Google Meet recording + storage | Audio + video stream of recorded meetings (operator-controlled record toggle) | EU (Google Workspace EU region) | DPF + UK Extension; SCCs + UK IDTA fallback | https://cloud.google.com/terms/data-processing-addendum/ | 2026-05-09 |
| Backblaze (Backblaze, Inc.) | B2 encrypted cloud backup of per-client encrypted volume | Encrypted blobs (Restic chunk-encrypted; Backblaze sees ciphertext only) | US (Backblaze primary US datacentres) | DPF + UK Extension; SCCs + UK IDTA + TRA fallback | https://www.backblaze.com/company/policy/dpa-for-eea-eu-residents | 2026-05-09 |
| Whisper-local: faster-whisper (open-source, OpenAI Whisper large-v3-turbo int8 via faster-whisper 1.2; runs on master-tier host, NOT lab nodes) | Audio-to-text transcription on operator workstation | Raw audio (decrypted in-memory only during transcription) | UK (master-tier operator workstation; tag:master Tailscale-tagged host – lab is dogfood/bootstrap experimentation only, NEVER live client) | N/A (no third-party transfer; on-device processing) | N/A (open-source model; no DPA needed) | 2026-05-10 |
| Whisper-local: whisperX (open-source, whisperX 3.0 forced alignment; runs on master tier alongside faster-whisper above) | Word-level timestamp alignment of transcript segments | In-memory aligned segments (raw audio decrypted only during processing) | UK (master tier; same workstation as faster-whisper above) | N/A (on-device) | N/A (open-source; no DPA needed) | 2026-05-10 |
| Whisper-local: pyannote 3.1 (open-source, pyannote.audio 3.1 speaker diarisation; runs on master tier; HuggingFace model download requires HF token, which is operator-only and never transmitted to clients) | Speaker diarisation labelling segments as SPEAKER_ | In-memory diarisation labels | UK (master tier; same workstation as above) | N/A on-device for diarisation; one-time HuggingFace model download via DPF/UK Extension when first installed | N/A (open-source; one-time HF download covered by HuggingFace DPF entry) | 2026-05-10 |
| Cloudflare (Cloudflare, Inc.) | Email Routing for hello@hoiboy.uk inbound (consent / objection / erasure-request emails relating to recordings) | Inbound email metadata + body (transient routing only) | US (Cloudflare primary, global edge network) | DPF + UK Extension; SCCs + UK IDTA fallback | https://www.cloudflare.com/cloudflare-customer-dpa/ | 2026-05-09 |
| Brevo (Sendinblue SAS) | SMTP relay for outbound transactional emails (consent confirmations, erasure receipts, sub-processor change notifications) | Email metadata + body (transient relay; Brevo retains delivery logs per their DPA) | EU (Brevo France) | EU adequacy + UK adequacy (Brevo France-resident); no SCCs needed for UK to EU | https://www.brevo.com/legal/termsofuse/ (DPA section) | 2026-05-09 |
Change-notification mechanism
When this page updates, affected Clients on active engagements receive an email to the engagement-letter signatory’s email address with:
- The vendor change (added / replaced / removed).
- The effective-date (at least 30 days from the notification date per Article 28(2) general written authorisation flow).
- A summary of the operational impact (which artefact category is affected; which transfer mechanism applies).
- The Client’s right to object on reasonable grounds within the 30-day window.
- The pro-rata refund right per SOW §5 if objection cannot be resolved.
Community submission form (public site feature)
This section is separate from the consultancy sub-processor list above. The Asians & Gingers in Tech “Get featured” form is a public site feature, not part of any client engagement, MSA, SOW, or the DPA Annex, so it carries its own disclosure and is not subject to the client change-notification mechanism above. Intake (photo storage, spam protection, delivery) uses Cloudflare, already the site’s infrastructure provider. The approval step, where we email the submitter the exact final wording of their feature and read their reply because nothing is published without their emailed approval, uses Google (the Gmail API on hoiboyuk@gmail.com); Google is a distinct processor of the submitter’s data and is listed below.
Publishing a feature uses GitHub: this site’s content lives in a public GitHub repository, so a feature that goes live is committed there and stays in that repository’s public history. Preparing the announcement uses Google Drive: the published images and the announcement copy are written to the operator’s business Drive as a per-feature posting kit. Alongside those, the submission and the approval evidence are also held in local storage on the operator’s own workstation (the workstation is the operator’s own equipment, not a third party, so it has no row below; what it retains is described in the Privacy Notice retention section). Each third-party processor is listed below.
| Service | Role for the form | Data processed | Retention |
|---|---|---|---|
| Cloudflare R2 | Private object storage for submitted photos | The uploaded photo (private bucket, not publicly reachable) | Auto-expires 90 days after upload |
| Cloudflare Turnstile | Bot / spam protection on the form | Visitor IP address + a challenge token (verified server-side) | Transient (verification only) |
| Cloudflare email (Email Routing + native send) | Delivers the submission to hello@hoiboy.uk | The submitted form fields + photo, as an email | Per inbox retention |
Google Gmail (Google LLC, hoiboyuk@gmail.com; Gmail API, least-privilege gmail.send + gmail.readonly scopes) | Emails the submitter the exact final wording of their feature for approval and reads their reply (the “no publish without your emailed approval” step) | The submitter’s email address, the final feature wording (their story), and their approval reply | Kept as part of the feature’s legal-evidence record (see the Privacy Notice retention section) |
| GitHub (GitHub, Inc., a Microsoft company) | Public source repository and site build for a published feature: this site’s content is stored and built from a public GitHub repository | The published photo, the published name, and the published story, committed to a public repository | Permanent in that repository’s git history for as long as the feature is published. On an erasure request we also run the git-history purge described in the Story Guidelines take-it-down section; copies already taken by third-party forks, clones and caches are outside our control |
| Google Drive (Google LLC; the operator’s business Drive, synced from the operator’s workstation) | Per-feature posting kit, so a published feature can be announced on the community’s social channels | The published images (never the raw photo you uploaded), the published name, and a condensed retelling of the published story | Kept while the feature is published, and deleted when the feature is taken down |
Cloudflare’s DPA, processing location (US primary, global edge), and UK-to-US transfer mechanism are the same as the Cloudflare row in the consultancy table above.
The Google services in this section are a different deployment from the Google row in the consultancy table above, which is a Google Workspace EU instance operated by Google Ireland Limited. Gmail on hoiboyuk@gmail.com and the operator’s business Google Drive are operated by Google LLC, processing in the US. Transfer mechanism: DPF + UK Extension (verify at https://www.dataprivacyframework.gov/list), with SCCs + UK IDTA as fallback. Governing terms: https://policies.google.com/terms and https://policies.google.com/privacy.
GitHub (GitHub, Inc., a Microsoft company) processes in the US. Transfer mechanism: DPF + UK Extension (verify at https://www.dataprivacyframework.gov/list), with SCCs + UK IDTA as fallback. Privacy statement: https://docs.github.com/en/site-policy/privacy-policies/github-privacy-statement.
The operator’s own workstation is in the UK, so the local copy described above is not an international transfer.
Cross-references
- MSA §13 Notes, AI-assisted summaries, and data handling - 7-day audio / scope-lock transcript / HMRC-6yr brief retention; nothing leaves the workstation; 24h breach-notification.
- SOW §7.7 Recording + AI-transcription anchor - controller-classification + activation gate + retention table.
- DPA Schedule Annex 2 - source-of-truth canonical version of this list (per-engagement attached to each MSA + SOW).
- Privacy Notice - data-subject-facing Privacy Notice for site visitors and engaged clients.
Update cadence
This page is reviewed at:
- Engagement start (per-vendor DPF re-verification).
- Annual sub-processor list refresh (12-month cadence from previous refresh date).
- Ad-hoc on vendor delisting notice or material vendor change.
Last reviewed: 2026-07-28.