Legal
Sub-processors
The companies that help us run Copytone, what each one does, what it can see, and where.
Last updated 17 October 2026
Hetzner handles what your organisation uploads, and so does the company that runs our AI model, Anthropic. The others handle account, payment, email and website data. Before we add or replace a sub-processor, we tell customers at least 14 days ahead, as our data processing agreement sets out.
They handle what you upload
| Provider | What it does | What it can see | Where | Safeguard for UK data | Its terms and policies |
|---|---|---|---|---|---|
| Hetzner Online GmbH | Rents us the server that runs Copytone and stores its data. | Everything Copytone stores, including uploads. | Company in Germany. Server in Helsinki, Finland. | None needed. Finland is in the European Economic Area, which UK law recognises as adequate. | Privacy policyTerms and conditionsData protection at Hetzner |
| Anthropic | Runs the AI model Copytone uses, Claude. It reads your guides, chooses your word lists from what was counted, finds your customers' words for what your pages say, and writes one version of a sentence when someone asks. | Your guides, the wording being checked, and what your customers said, with names and contact details taken out. Anthropic may not train models on any of it. Anthropic deletes what we send and what it answers within 30 days. Only if something is flagged under its usage policy may it keep that for up to 2 years. | Anthropic, PBC, in the United States. | The UK Addendum to the EU Standard Contractual Clauses, in Anthropic's data processing addendum, which is part of its commercial terms. | Commercial termsData processing addendumHow long Anthropic keeps API data |
They handle account, payment, email and website data
| Provider | What it does | What it can see | Where | Safeguard for UK data | Its terms and policies |
|---|---|---|---|---|---|
| Stripe | Takes payment, and runs trials, subscriptions, renewals and cancelling. | Your billing and payment details. Card numbers go straight to Stripe, never to us. Stripe also uses payment data as its own controller, to stop fraud and meet financial rules. | The Stripe company depends on where our Stripe account is registered. For a UK account it is Stripe Payments Europe, Limited, in Ireland. Payment data is processed by Stripe, LLC, in the United States. | Stripe says Stripe, LLC is certified under the EU-US Data Privacy Framework with its UK extension, and the UK Addendum applies if that ever does not. | Privacy policyData processing agreementData transfers addendum |
| Resend | Sends sign-in links and account emails, from when email sign-in is switched on. | Your email address and the emails we send you, kept for 30 days. | Plus Five Five, Inc., trading as Resend, in the United States. Data stored in the United States. | The UK Addendum to the EU Standard Contractual Clauses in its data processing agreement. Resend also says it is certified under the EU-US Data Privacy Framework with its UK extension. | Data processing agreementGDPRIts sub-processors |
| Cloudflare, Inc. (Turnstile) | Checks that a person, not a bot, is signing up, from when the human check is switched on. | Your IP address, browser details and details of your connection, at sign-up. Cloudflare also uses them, as its own controller, to improve its bot detection. | Company in the United States. Its network handles requests around the world. | Cloudflare says it is certified under the EU-US Data Privacy Framework with its UK extension, with the UK Addendum to the EU Standard Contractual Clauses if that lapses. | Turnstile privacy addendumData processing addendum |
| PostHog, Inc. (EU Cloud) | Analytics: which pages are used, and how people arrive at them. | The page, the site you came from, campaign tags, your browser, system and device type, and a random ID for the open tab. Never your IP address, name or email address. PostHog keeps events for one year on its free plan and seven years on paid plans. | Company in the United States. Our analytics is stored on its EU Cloud, in Frankfurt, Germany. | Stored in the European Economic Area. PostHog's data processing agreement adds the UK Addendum, and PostHog says it is certified under the EU-US Data Privacy Framework with its UK extension. | Privacy policyData processing agreementIts sub-processors |
| SiteGround Hosting Ltd. | Hosts our inboxes: email sent to copytone.co, our replies, and the short alert Owen gets when someone signs up, starts a trial, pays or leaves. | The emails you send us, what you attach, and our replies. When you sign up or your plan changes, Owen is sent your email address, your company's name and the plan. | Company in England and Wales. Our inbox is on its servers in London, run on Google Cloud. | In the UK. SiteGround says it uses the UK International Data Transfer Agreement, and the EU Standard Contractual Clauses, for data it moves abroad. It handles the email you choose to send us and those alerts, never your organisation's uploads. | Privacy policy |
| Google Fonts | Serves the fonts on pages that show the studio, including the examples on our homepage. | Your IP address and browser details, when a page fetches its fonts. | Google LLC, in the United States. | It handles no uploads. Google's own privacy policy applies. | Google Fonts privacyGoogle privacy policy |
Resend and Cloudflare Turnstile start work when email sign-in and the human check are switched on. They are listed now so that customers hear about them first. This list changes before a new provider starts work, not after. The date at the top shows when it last changed.