Legal · Draft
Sub-processors
StGatherly uses a small number of trusted third parties to help deliver the Service. This page lists the sub-processors that may process personal data on behalf of churches. This is a draft for review and is not yet final.
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Microsoft Azure | Application hosting, compute, and file/asset storage | Application infrastructure; uploaded assets and files | United Kingdom |
| Supabase | Primary application database | All Church Personal Data stored in the database | United Kingdom (London) |
| Brevo | Transactional and campaign email delivery | Recipient email addresses, names, and message content | European Union |
| OpenRouter | Routing requests for AI-assisted drafting, content, and assistant features | Content submitted to AI features (opt-in, per use) | United States |
| Microsoft (Teams) | Microsoft Teams messaging channel | Recipient identifiers and message content | United States / global |
| Microsoft Azure Application Insights | Application performance and error monitoring | Diagnostic and usage data, which may include limited personal data in logs | United Kingdom [CONFIRM region] |
| [CONFIRM: support mailbox provider, e.g. Microsoft 365] | Handling customer support enquiries by email | Anything you include in a support email | [CONFIRM region] |
| [CONFIRM: payment processor]Not yet active | Payment and subscription billing | Billing contact and payment details | [CONFIRM region] |
Where your data lives. The application runs on Microsoft Azure in the United Kingdom, and church data is stored in our Supabase database in the United Kingdom (London). Some sub-processors are located outside the UK; where that involves a transfer, we rely on an appropriate safeguard as described in our Data Processing Addendum.
AI routing. OpenRouter routes AI requests to underlying model providers. We only send content to AI features when you choose to use them, and we configure routing to providers that do not train on your data. [CONFIRM: OpenRouter data policy is set to no-training / zero-retention providers]
Messaging channels. Microsoft Teams only processes data when a church chooses to use it. It has its own terms and opt-in requirements the church is responsible for meeting.
Changes. When we intend to add or replace a sub-processor that handles Church Personal Data, we will update this page and give notice as described in our Data Processing Addendum, so churches can object on reasonable data protection grounds.
Questions? Contact hello@stgatherly.com.