Subprocessors

The full list

These are every company that touches personal data on our behalf. There is no advertising network, no data broker and no analytics vendor on this list, because we do not use any.

Company	What it does	What it sees	Where
Cloudflare, Inc.	Website hosting, DNS, CDN, bot protection, and the nightly backup of the orders	Connection data: IP address, browser string, requested page. The orders held in the backup, encrypted at rest	Global edge; US parent, under standard contractual clauses
Supabase	Database for orders, baskets and products	Order and customer data	Hosted in Germany (EU)
Brevo (Sendinblue SAS)	Order emails and the harvest note	Name, email address, delivery address, order summary	France (EU)
Couriers	Delivering the parcel	Name, delivery address, phone number	Varies by destination; EU

No card processor appears on this list because there is no card. Your bank and ours see the transfer, as they must in order to move the money, and they act as controllers in their own right rather than as processors for us.

What is deliberately not here

Worth stating plainly, because most shops of this size use all of them:

• No Google Analytics or any other third party analytics.
• No Meta pixel, no advertising or conversion tags.
• No Google Fonts. Our typefaces are served from our own domain.
• No embedded maps, videos or social widgets.
• No customer support chat widget.
• No CRM or marketing automation platform.

Changes to this list

If we add a subprocessor we will update this page before it starts processing anything. If you have a standing objection to a particular provider, tell us at our contact form.