[PENDING] or [TODO: solicitor] will be confirmed before launch.Legal · Data processing
Sub-processors
Last updated: 15 June 2026
To provide ScaffQuote, Bond Labs Limited engages the third-party service providers (“sub-processors”) below to process personal data on our behalf. We require each to provide appropriate safeguards and, where applicable, to act under a data processing agreement (DPA).
Current sub-processors
| Provider | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Anthropic | AI photo-measurement and job-description parsing | United States | SCCs |
| fal.ai | Photoreal scaffold image generation | United States | SCCs |
| Supabase | Database, authentication, and photo/file storage | EU — London (eu-west-2) | In-region (EU) |
| Vercel | Application hosting and content delivery (CDN) | United States / global | SCCs |
| Resend | Transactional email delivery (quotes, sign-in codes) | United States | SCCs |
| Stripe | Payments — NOT YET ACTIVE (planned future feature) | United States / global | SCCs |
“SCCs” = EU Standard Contractual Clauses with the UK International Data Transfer Addendum, where data is transferred outside the UK.
Data processing agreements
A data processing agreement (DPA) is in place, or is to be executed, with each sub-processor listed above. [PENDING owner action — confirm and countersign each DPA; confirm transfer mechanism per provider.]
Changes
As ScaffQuote evolves we may add or change sub-processors. We’ll update this page and the “Last updated” date. For how this fits our wider data handling, see our Privacy Policy. Questions? Email privacy@scaffquote.com [PENDING confirm].