1 Scope
MarginNudge uses the providers below to operate its marketing website, authenticated product and supporting business processes. A provider may act as a processor, subprocessor, independent controller or a combination depending on the service and data involved. Inclusion does not mean every provider receives every category of data.
MarginNudge is a trading name of MarginNudge Ltd, registered in England and Wales under company number 17470390, with its registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.
2 Product and operational providers
| Provider | Purpose | Information | Processing locations | Safeguard |
|---|---|---|---|---|
| Lovable Labs Incorporated | Application development and hosting platform used to build and operate the web application. | Account, application, technical and Customer Data as configured. | United States and other locations under provider terms. | UK Addendum/SCCs or other lawful mechanism. |
| Supabase Pte. Ltd | Authentication, database, storage, row-level security and server-side functions. | User identities, workspace and Customer Data, PDFs, audit and technical data. | Selected infrastructure region plus Singapore, United States or other support locations. | UK Addendum to SCCs and provider DPA. |
| Plus Five Five, Inc. (Resend) | Transactional account and user-confirmed quote email delivery. | Sender and recipient email, message content, PDF attachment and delivery events. | United States and provider subprocessor locations. | UK Extension to Data Privacy Framework and/or UK Addendum/SCCs. |
| PostHog, Inc. | Product analytics and adoption measurement. | Pseudonymous identifiers, device/usage events and feature interaction data; no sensitive quote text or recipient emails. | EU cloud recommended for UK launch; provider operations may involve the United States. | UK Addendum/SCCs and provider DPA. |
| Attio Limited | Customer relationship management for prospects and customers. | Business contact details, company details, sales activity, notes and communication history. | United Kingdom, EEA, United States and provider subprocessor locations. | Provider DPA and UK transfer safeguards where required. |
| CookieYes Limited | Consent banner, preference centre, cookie scanning and consent records. | Device/browser data, IP address, consent choices and timestamps. | United Kingdom, EEA, United States and provider subprocessor locations. | Provider DPA and UK transfer safeguards where required. |
3 Website, payments and connected services
| Provider | Purpose | Information | Processing locations | Safeguard | Role |
|---|---|---|---|---|---|
| Google LLC | Google Analytics 4 and optional Google sign-in. | Cookie/device and usage information; for sign-in, account identity and work email selected by the user. | United Kingdom intake and global processing, including the United States. | Google terms, UK transfer safeguards and consent for analytics under the MVP configuration. | Processor/controller depending on configuration. |
| Stripe Payments UK Limited and relevant Stripe affiliates | Checkout, card-backed trial, subscription billing, retries, refunds and payment administration. | Account, billing, transaction, payment method and fraud-prevention information. MarginNudge does not receive full card details. | United Kingdom, EEA, United States and global Stripe locations. | Stripe DPA, UK transfer safeguards and applicable payment rules. | Processor and/or independent controller depending on activity. |
| Calendly LLC | Demo and meeting scheduling. | Name, work email, company, booking details, timezone and information entered in the scheduling form. | United States and provider subprocessor locations. | UK Extension to Data Privacy Framework and/or UK Addendum/SCCs. | Processor; also controller for specified operational purposes. |
4 Provider configuration requirements
- MarginNudge should select a UK or EEA hosting region where the provider offers one and it is operationally suitable.
- PostHog Cloud EU should be selected for the UK MVP unless a documented reason supports another configuration.
- Google Analytics and PostHog must not receive client names, quote free text, salary information, recipient email addresses or other sensitive quote content.
- CookieYes must scan both marginnudge.com and app.marginnudge.com and block non-essential tracking until the applicable choice is recorded.
- If a separate PDF-generation, file-storage, support, monitoring or hosting provider is introduced, it must be assessed and added before it begins processing Customer Personal Data.
- MarginNudge must maintain current contracts and data protection terms with each provider where required.
5 Changes and objections
MarginNudge will provide at least 15 days’ notice before a new subprocessor begins materially processing Customer Personal Data. Customers may object during that period on reasonable data protection grounds by emailing contact@marginnudge.com. The parties will work in good faith to resolve a valid concern in accordance with the Data Processing Agreement.
6 Other recipients
Professional advisers, regulators, courts, law-enforcement bodies and parties to a genuine corporate transaction may receive information where necessary and lawful. They are not ordinary service subprocessors and may act as independent controllers.