Sub-processors

Last updated 25 June 2026 · published centrally by AKdev and shared across every app it publishes, Crub included.

A sub-processor is a third party that processes personal data on our behalf. This register names them per product, because the sets genuinely differ — one product’s identification service is not another product’s calendar API, and a single flat list would either imply every sub-processor touches every app or hide which one does what.

Read it alongside the Privacy Policy, which sets out the lawful bases, retention and your rights. This document answers only one question: who else touches it.

Everything we publish

These apply across every AKdev Ltd product and website.

Vercel

What it does: hosts and serves our websites and the web versions of our apps, and provides the traffic analytics and performance measurement embedded in the websites.
What it receives: the content of requests to our sites, including IP address, user agent and requested URL.
Where it processes: the United States, with pages served from Vercel’s global edge network.

Cloudflare

What it does: runs the API behind each app, the bot check on our forms, and the network in front of our analytics.
What it receives: every request to an app’s API, including IP address, the content you send and files you upload, in transit.
Where it processes: Cloudflare’s global network, nearest the person making the request.

PostHog

What it does: product analytics — which screens are used and how often.
What it receives: events and page views from signed-in use, tied to an account identifier. It does not receive what anyone writes into an app.
Where it processes: the European Union.

Stripe

What it does: takes payment for paid plans and keeps the billing record.
What it receives: your name, email address, billing address and payment details. Card numbers go to Stripe directly and never reach us.
Where it processes: the United Kingdom, the European Union and the United States.

Google Workspace

What it does: receives messages sent through the contact form on each of our websites.
What it receives: the name, email address, organisation and message you enter.
Where it processes: the United States and the European Union.

Sign-in providers — yours, not ours

Every app lets you sign in with Google, Apple or Microsoft if you choose to. Those are accounts you already hold with them, under their own terms; when you use one, it tells us who you are and nothing else. They are not sub-processors we chose, and they are listed here so their absence is not mistaken for an omission.

Google Fonts — not a sub-processor, and worth saying why

Our sites set type in fonts originally distributed by Google. They are downloaded once when the site is built and served from our own domain, so a visitor’s browser never contacts Google and no request data reaches it. It is listed here because its absence from a register is the kind of thing a careful reader checks.

Crub

Supabase

What it does: Crub’s database, sign-in and photo storage.
What it receives: your account, your gardens and everything recorded in them, and the photographs you take.
Where it processes: London, United Kingdom.

Kindwise

What it does: identifies plants, mushrooms and insects from a photograph.
What it receives: the photographs taken for an identification, and the location they were taken at when you allow it.
Where it processes: the European Union.

Pl@ntNet

What it does: identifies plants from a photograph.
What it receives: the photographs taken for an identification, without their location.
Where it processes: the European Union.

Google Maps Platform

What it does: draws the satellite view a garden is mapped over.
What it receives: the coordinates of the garden being mapped, from your browser.
Where it processes: the United States.

Postcoder

What it does: finds an address as you type it.
What it receives: the address you type and the one you choose.
Where it processes: the United Kingdom.

Open-Meteo

What it does: provides the weather for a garden.
What it receives: the garden’s coordinates, and nothing that identifies you.
Where it processes: the European Union.

Crub uses no language model. Its suggestions are worked out from its own plant library, and the services above are specialist image-recognition services rather than general-purpose AI.

KinopiQ

Supabase

What it does: KinopiQ’s database, sign-in and document storage. Text is read out of uploaded documents inside it, with no other party involved.
What it receives: your organisation’s workspace, its evidence and the documents you upload.
Where it processes: Dublin, Ireland.

Resend

What it does: sends invitations and account email.
What it receives: the recipient’s email address and the workspace they are invited to.
Where it processes: Dublin, Ireland.

KinopiQ uses no language model today. When it reads documents with one, the provider will be named here before any document is sent to it.

This section matters more than the others. The people who read a sub-processor register are, very often, answering the same questions for their own certification — and an international-transfer question they cannot answer about their tooling is a real obstacle to them, not a formality.

BusyWait

Supabase

What it does: BusyWait’s database and sign-in.
What it receives: your account, the calendar connections you make (with their credentials encrypted), and the events BusyWait keeps in step.
Where it processes: Dublin, Ireland.

Resend

What it does: sends account email, including the one telling you a calendar connection needs reconnecting.
What it receives: your email address, your workspace’s name and which provider needs attention.
Where it processes: Dublin, Ireland.

Your calendars — yours, not ours

BusyWait connects to calendar providers you already hold accounts with: Google Calendar, Microsoft Outlook and Apple iCloud. Those are your own services rather than ours, under their own terms, and the distinction is a real one — BusyWait reads from and writes to them because you asked it to.

BusyWait uses no language model, and never will. That absence, beside the products that do, is the clearest evidence available for a claim the sites make in prose.

SwingFactor

Supabase

What it does: SwingFactor’s database, sign-in and source storage.
What it receives: your questions and everything modelled under them, and the files and links in your workspace’s source library.
Where it processes: London, United Kingdom.

Anthropic

What it does: drafts the model of a question — its options, propositions, evidence and numbers.
What it receives: the question being drafted and the text of its sources. Research by SwingFactor on the open web sends the question, never an uploaded document.
Where it processes: outside the United Kingdom, including the United States.

Cloudflare Workers AI

What it does: turns uploaded documents into text SwingFactor can read.
What it receives: the content of the documents you upload.
Where it processes: Cloudflare’s global network.

Resend

What it does: sends invitations and account email.
What it receives: the recipient’s email address and the workspace they are invited to.
Where it processes: Dublin, Ireland.

How this register changes

When a sub-processor is added, removed or replaced, this register is updated and its review date changes with it. It is served from one source and mirrored on every product site, so the version you are reading is the current one wherever you are reading it. Customers who want advance notice of a change can ask for it at hello@crub.ai and we will keep a list.