Sub-processors
Version 1.1 · Effective August 24, 2026 · Referenced by the Privacy Policy and the Data Processing Addendum
These are the third parties that process data on our behalf in order to run the Service. This page is the current list, and it is the page that changes when a provider does - which is why the Privacy Policy and the Terms refer to it rather than naming providers inline. A contract should not need amending because a database moved.
Every provider here is engaged under a data processing agreement limiting them to the purpose described, and none of them is permitted to use your data for their own ends. Where a provider processes personal data outside the EEA or the UK, the transfer is made under the European Commission's Standard Contractual Clauses.
The list
A processing location below is the region a provider runs our deployment in. Where the exact location matters to you - a transfer assessment, a customer of your own asking - write to privacy@bidhelm.com and we will confirm it in writing rather than leave you to infer it from a provider's own documentation.
Google — Ads API, Content for Shopping API
Reads and writes the campaigns you authorise; receives the conversions we upload for you. Your data was already there; this is the account you connected.
Processing location: United States, global
Anthropic — Claude models
Analysis, drafting, and the in-product assistant. Receives campaign and keyword performance, search terms, spend figures, your public site content, and what you type in chat. Contractually prohibited from training on it.
Processing location: United States
OpenAI
Image generation for ad creative, and some drafting. Contractually prohibited from training on the data sent.
Processing location: United States
Clerk
Sign-in, sessions, and organisation membership. Holds your name and email address.
Processing location: United States
Neon
The managed PostgreSQL database holding your account, your campaign data, and any leads captured on a hosted page.
Processing location: European Union (Frankfurt)
Railway
Runs the API, the scheduled optimisation work, and the landing-page builder. It processes your data in transit; the data itself rests in the database above.
Processing location: European Union (Netherlands)
Vercel
Serves this website, stores generated images, and provides the website's cookieless analytics - which identifies a visitor by a hash of the incoming request and discards it after 24 hours.
Processing location: United States, global edge
PostHog
Product analytics inside the signed-in dashboard. It is not used on the public website.
Processing location: United States
Axiom
Application logs and error monitoring, used to operate and debug the Service. Logs can incidentally contain identifiers such as an account ID or an IP address.
Processing location: United States
Loops
Sends the one email the Service still sends: an invitation to join an organisation. No lifecycle, report, or marketing email is sent.
Processing location: United States
Payments
Card payments are handled by a regulated third-party payment provider that also acts as Merchant of Record, issues your receipt, and calculates and remits tax. It is described by role rather than by name, in this page and in the Billing & Payment Terms, so that replacing it is not a change to your contract. It receives your billing details and your subscription information; we do not store full card numbers at any point. If you need the current provider named - for your own vendor records, or for a data protection assessment - write to privacy@bidhelm.com and we will tell you.
Changes to this list
A new sub-processor that will handle personal data is published here at least 30 days before it starts. If you are a customer and you object to one on reasonable data protection grounds, tell us at privacy@bidhelm.com within those 30 days. We will either find a way to run the Service for you without it or, where that is not possible, you may terminate the affected part of the Service and we will refund any fee already paid for a period after termination. The objection process, and what happens if we cannot resolve it, is set out in Section 6 of the Data Processing Addendum.
Replacing a provider with another doing the same job is treated the same way as adding one. Removing a provider needs no notice.
Questions
Data protection: privacy@bidhelm.com · Security: security@bidhelm.com