Sub-processors
The outside services that process personal data for Agentic OS Group when you use this website or the Agentic OS workspace. Last updated 27 September 2026.
Current sub-processors
| Provider | What for | Data involved | Whose data | Where |
|---|---|---|---|---|
| Vercel | Hosting of the website and application | All data passing through the website | Guest, supplier and staff data | UK (London) for the application; worldwide network for delivering pages |
| Supabase | Database and secure sign-in for guests and suppliers | Account, booking, registration, message and document records | Guest, supplier and staff data | UK (London) |
| Square | Card payments and refunds | Payment details (entered directly with Square — card numbers are never stored by us) | Guest, supplier and staff data | Provider’s own locations (see its privacy notice) |
| Google (Gmail) | Sending booking and account emails | Name, email address and message content | Guest, supplier and staff data | Provider’s own locations (see its privacy notice) |
| Microsoft 365 | Staff email, calendars and documents used to handle enquiries | Correspondence and documents you send us | Guest, supplier and staff data | The operator’s own Microsoft 365 tenant |
| TypeSafe AI (Jev) | Sorting incoming operations email by what needs to happen next (for example urgent or needs a reply) | Sender, subject and the first 400 characters of each email, which can include names and booking details; nothing is stored by us after sorting | Guest, supplier and staff data | Provider’s own locations (see its privacy notice) |
| Property management system | Reservations, units and stays | Booking and stay details | Guest, supplier and staff data | Provider’s own locations (see its privacy notice) |
| HubSpot | Customer relationship management for corporate clients handled by our sales team | Business contact and enquiry details | Guest, supplier and staff data | Provider’s own locations (see its privacy notice) |
| OpenStreetMap | Maps on the locations pages | Your browser loads map images directly; no account data is shared | Guest, supplier and staff data | Provider’s own locations (see its privacy notice) |
| GitHub | Source code, automated checks and encrypted nightly database backups | Database backups (encrypted before upload; only the operator holds the key) | Guest, supplier and staff data | USA |
| Vercel AI Gateway and the AI model providers it routes to | AI assistants used by staff (Chat Agents, AI Router, AI Workbench) | Whatever staff type or paste into an AI assistant | Staff data only | Provider’s own locations (see its privacy notice) |
| Microsoft Azure AI | Department AI agents | Staff questions to the agents and the workspace data they look up | Staff data only | The operator’s own Azure subscription |
| Asana | Work OS project views (when connected) | Project and task details | Staff data only | Provider’s own locations (see its privacy notice) |
Where a provider processes data outside the UK, the transfer is protected by the safeguards UK law requires, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision.
Changes to this list
We update this page before a new sub-processor starts processing personal data. Business customers under our data processing agreement may object to a new sub-processor within 30 days of the change; contact agenticos@agentic.os.