BuildflowSub-processors
List version 1.0 · updated July 2026
These are the providers that may process personal data on behalf of Buildflow. Providers marked optional only process data if you switch that integration on. We update this page and increase the version number before adding a new sub-processor. Email privacy@buildflow.builders to be told in writing when it changes. Our data processing agreement is available to download.
| Provider | Purpose | Processing location | Status |
|---|---|---|---|
| Supabase (managed database, authentication and file storage) | Hosts the application database, sign-in records and uploaded documents and photos. | United Kingdom / European Union | Always used |
| Cloudflare | Serves the application, TLS termination and edge request handling. | Global edge network; primary processing UK/EU | Always used |
| Lovable AI Gateway (routing to OpenAI and Google model providers) | Processes only the specific content you submit to an AI feature — a drawing, quotation or enquiry email — to return an analysis. | United States | Always used |
| Resend | Delivers outbound transactional email such as notifications and portal invitations. | European Union / United States | Always used |
| Google (Gmail, Calendar and Drive) | Reads enquiry email, syncs calendar events and stores lead documents you choose to sync. | United States | Optional — only if you connect it |
| Docmail (CFH Docmail Ltd) | Prints and posts letters you dispatch to planning contacts. | United Kingdom | Optional — only if you connect it |
| Twilio | Sends SMS escalation alerts where your workspace enables them. | United States | Optional — only if you connect it |
| Xero / Sage | Exchanges invoice and payment records with your accounting system. | United Kingdom / European Union | Optional — only if you connect it |
Transfers outside the UK/EEA rely on the UK International Data Transfer Addendum and the EU Standard Contractual Clauses with the relevant provider.