Sub-processors
Last updated: 15 October 2026
About this list
These are the providers that W&I Studio Ltd (trading as TrainedTeam, company number 17182553) uses to run the TrainedTeam website at trainedteam.com and the app at app.trainedteam.com, where they process personal data on our behalf.
When your organisation uses TrainedTeam to train and track its staff, your organisation is the controller of that data and we are its processor (section 11 of our Terms of Service). The providers below are then our sub-processors, and each works under written data processing terms that meet UK GDPR Article 28. Our Privacy Policy explains how we use personal data, and our Cookie Policy covers the analytics tools.
How we tell you about changes
When we add or replace a sub-processor, we will:
- Update this page and add the change to the list at the bottom.
- Email customers on Pro and Enterprise plans at least 30 days before the change takes effect, where commercially reasonable.
- Let customers object to the change. If an objection cannot be resolved, the customer may end their subscription with a pro-rata refund of any unused prepaid term.
For organisations on the free plan, this page is the record of changes. Questions go to privacy@trainedteam.com.
Current sub-processors
Vercel Inc.
Hosting, server functions, web analytics and performance insights
- Used on
- Website and app. Web analytics only if you allow analytics.
- Personal data
- IP address, browser and device details, the pages requested, and form submissions in transit.
- Location
- Global edge network. The app’s server functions run in the EU (Dublin, Ireland).
- Transfer safeguard
- UK Addendum to the EU Standard Contractual Clauses; UK-US Data Bridge where applicable.
Supabase Inc.
Database, sign-in and file storage
- Used on
- App, and the website’s instruction creator.
- Personal data
- Account details (name, email address, hashed password), sign-in sessions, and what your organisation keeps in TrainedTeam: procedures, training records and results, e-signatures and uploaded files. From the website: images uploaded to the instruction creator, and a daily count of PDFs sent to each address.
- Location
- EU (Ireland).
- Transfer safeguard
- UK Addendum, for support and operations access only. The data stays in the EU region.
Resend
Email delivery
- Used on
- Website and app.
- Personal data
- Recipient email address and name, and the content of the email: for example an invitation, a reminder naming the person and the training that is due, or a requested PDF.
- Location
- United States.
- Transfer safeguard
- UK Addendum to the EU Standard Contractual Clauses.
Anthropic, PBC
AI writing features: drafting and rewriting instructions, quizzes and answers
- Used on
- Website (instruction creator) and app.
- Personal data
- The text you submit and the content the AI works on, which can include personal data you put in it. Anthropic deletes it within 30 days and does not use it to train models.
- Location
- United States.
- Transfer safeguard
- UK Addendum to the EU Standard Contractual Clauses; UK-US Data Bridge where applicable.
OpenAI, L.L.C.
Audio narration of instructions (text to speech)
- Used on
- App, when someone creates an audio narration.
- Personal data
- The title and steps of the instruction being narrated. OpenAI does not use it to train models.
- Location
- United States.
- Transfer safeguard
- UK Addendum to the EU Standard Contractual Clauses; UK-US Data Bridge where applicable.
Cloudflare, Inc. (Turnstile)
Checking that a form is filled in by a person, not a bot
- Used on
- Website and app.
- Personal data
- IP address, browser details and signals from the page.
- Location
- Global edge network.
- Transfer safeguard
- UK Addendum to the EU Standard Contractual Clauses.
PostHog Inc.
Product analytics, session replay and error tracking
- Used on
- Website and app, only if you allow analytics. The app also records a few account events on its servers.
- Personal data
- A random device identifier kept in a cookie, the pages visited and actions taken, recordings of how pages are used, and error reports. Website recordings hide form fields and anything typed into the instruction creator. App recordings hide every word on the screen and every image. The app’s server events carry the account ID, never a name, email address or training result.
- Location
- EU (Germany).
- Transfer safeguard
- UK Addendum to the EU Standard Contractual Clauses, for US support and operations access.
Google LLC (Google Analytics 4)
Website analytics
- Used on
- Website only, and only if you allow analytics.
- Personal data
- Cookie identifiers, the pages visited, browser and device details, and IP address.
- Location
- United States and other countries.
- Transfer safeguard
- UK-US Data Bridge; UK Addendum to the EU Standard Contractual Clauses.
Stripe
Payments for paid plans
- Used on
- App.
- Personal data
- The account owner’s email address, the workspace name, billing address, tax ID, and card details entered on Stripe’s own checkout page. Stripe is also an independent controller for some purposes, such as preventing fraud.
- Location
- United States and other countries.
- Transfer safeguard
- UK Addendum to the EU Standard Contractual Clauses; UK-US Data Bridge where applicable.
Other services that receive data
These are not our sub-processors: you or your organisation choose to use them, and they act under their own terms.
- Google and Microsoft sign-in. If you choose to sign in with Google or Microsoft, they confirm who you are and share your name, email address and profile with us.
- Embedded videos and documents. Content your organisation embeds from YouTube, Loom, Vimeo or Google Drive loads from those providers, which receive your IP address and browser details when you view it.
- Google document viewer. PowerPoint and Keynote files that your organisation uploads are shown through Google's document viewer, which fetches the file and receives your IP address and browser details when you view it.
Changes to this list
| Date | Change |
|---|---|
| 15 October 2026 | This list published. Added the app’s PostHog, which runs only if you allow analytics, OpenAI, Stripe, and Google Analytics on the website. |
| 11 September 2026 | Added PostHog on the website, which runs only if you allow analytics. |
| 30 April 2026 | First list: Vercel, Supabase, Resend, Anthropic and Cloudflare Turnstile. |