Sub-processor List
Last updated 30 October 2026
Version 4.1 | Last updated 30 October 2026
1. About this list
1.1 This Sub-processor List is published by Earnly Limited, a private limited company registered in England and Wales (company number 16183799), registered office 41 New Cross Street, Swinton, Manchester, England, M27 4TU ("Earnly", "we", "us", "our").
1.2 It names the service providers that process personal data for us to run the Earnly platform (the "Platform") and our website, and the providers they in turn use, together with the other organisations that receive personal data when you use the Platform. It forms part of our Privacy Policy, and terms defined in the Privacy Policy have the same meaning here, including "Account", "Business User", "Consumer", "Open Banking Data" and "Provider".
1.3 Earnly is the controller of the personal data processed through the Platform. The providers marked "Processor" act only on our written instructions, under contracts that meet Article 28 UK GDPR. A provider marked "Sub-processor" is engaged by one of our processors, on terms that give the same level of protection.
1.4 We do not sell personal data, and no provider on this list may use your personal data for its own marketing or to train AI models. One AI provider, Anthropic, receives only a cleaned merchant name and transaction amount to suggest a category where our rules cannot, as explained in the AI Policy and section 10 of the Privacy Policy.
2. Who this applies to
2.1 This list applies to every Individual whose personal data we process, whether a Consumer, a sole trader or other Business User, or an individual acting for an Organisation, and to visitors to our website and people on our waitlist.
3. Providers
| Provider | Service | Personal data | Location | Role | Transfer safeguard |
|---|---|---|---|---|---|
| Supabase, Inc. | Database, user authentication and file storage | All Account data: identity and contact details, password hash, company and tax profile data, Open Banking Data, Outputs, receipt images, security logs, waitlist data | Data hosted in AWS eu-west-1 (Ireland). Supabase, Inc. is a US company and may access data from the United States for support and operations | Processor | Storage in Ireland: UK adequacy regulations for the EU. Access from the US: UK Extension to the EU-US Data Privacy Framework where Supabase is certified; otherwise the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, with a transfer risk assessment |
| Amazon Web Services EMEA SARL | Underlying cloud infrastructure for Supabase | As for Supabase, stored in encrypted form | Ireland (AWS eu-west-1) | Sub-processor (engaged by Supabase) | UK adequacy regulations for the EU |
| Cloudflare, Inc. | Application hosting and delivery (Cloudflare Workers and the Cloudflare global edge network) | Data passing between your browser and the Platform while you use it, IP address, request and security logs | Global edge network: requests are handled at the location nearest to you. Cloudflare, Inc. is a US company | Processor | UK Extension to the EU-US Data Privacy Framework where Cloudflare is certified; otherwise the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, with a transfer risk assessment |
| Lovable Labs Incorporated (the Lovable Cloud platform), 1 Lincoln St, Boston, MA 02111, USA | Building and hosting the Platform and website, and delivering our emails (Lovable Emails), including verification codes, consent expiry reminders, service messages and marketing emails | Name and email address, email content, delivery and unsubscribe records, IP address and request data, aggregate cookieless visitor statistics | United States (Lovable Labs Incorporated is a US company), using the infrastructure providers listed on this page | Processor | The UK International Data Transfer Addendum to the EU Standard Contractual Clauses, under Lovable's data processing agreement dated 17 November 2025, with a transfer risk assessment |
| Finexer Ltd | Open Banking connectivity: the account information service through which you connect your bank accounts | Your name or company name, email address and Account reference; consent records; Open Banking Data | United Kingdom | Independent controller for the account information service; our processor when delivering Open Banking Data to us (see section 5) | Not applicable (UK) |
| Google Cloud EMEA Limited (Google Workspace), Ireland, with Google LLC as its sub-processor | Our business email (privacy@, support@, complaints@ and security@earnly.co.uk), carrying support requests, complaints, data protection rights requests and other correspondence with you | Name, email address and the content of emails and attachments you send us or we send you | European Union and United States | Processor (Google LLC is a sub-processor engaged by Google Cloud EMEA Limited) | Within the EU: UK adequacy regulations for the EU. Transfers to the US: UK Extension to the EU-US Data Privacy Framework where Google is certified; otherwise the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, with a transfer risk assessment |
| Atlassian Pty Ltd (Confluence and Jira), Australia | Hosting our internal records and registers, including the complaints log, the data subject request log and the breach register | Name, email address, Account reference and the details of your complaint, request or any incident affecting you | Australia (Atlassian Pty Ltd), with hosting in the United States | Processor | The UK International Data Transfer Addendum to the EU Standard Contractual Clauses, with a transfer risk assessment, and the UK Extension to the EU-US Data Privacy Framework for Atlassian's certified US entities |
| Anthropic Ireland, Limited, with Anthropic, PBC (USA) as its sub-processor | AI categorisation suggestions: suggesting a category, using the Claude Haiku 4.5 model, for a transaction that our rules, your own rules and the merchant consensus table cannot categorise. Payments to or from individuals, person-to-person payments and transfers between your own accounts are never sent. Anthropic is contractually prohibited from training its models on the data. Inputs and outputs are deleted within 30 days, or kept for up to 2 years if Anthropic's automated trust and safety systems flag a request under its Usage Policy, or longer where the law requires | Cleaned merchant name and transaction amount only. No name, contact details, Account, company or bank account identifier, account number, sort code, raw bank description, reference or date | United States | Processor, under Anthropic's Data Processing Addendum (Anthropic, PBC is a sub-processor engaged by Anthropic Ireland, Limited) | EU Standard Contractual Clauses (Module 2) with the UK International Data Transfer Addendum (B1.0), with a transfer risk assessment |
| Google LLC (Google Fonts) | Web fonts loaded by your browser on some pages | IP address and browser details, sent directly by your browser when the page loads | United States and Google's global network | Provider of web content loaded by your browser | UK Extension to the EU-US Data Privacy Framework where Google is certified; otherwise the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, with a transfer risk assessment |
| jsDelivr | Content delivery network serving bank logo images on some pages | IP address and browser details, sent directly by your browser when the page loads | Global content delivery network | Provider of web content loaded by your browser | Your browser requests the file directly. No other personal data is shared and Earnly receives nothing from jsDelivr |
3.1 Google Fonts and jsDelivr. We are moving the fonts and bank logos to our own hosting. Once that is done, Google and jsDelivr will no longer receive your IP address and we will remove them from this list. This removal does not need advance notice.
3.2 Payment provider. The Platform is free of charge during early access and we do not process payments. If we introduce paid plans, we will name our payment provider on this list, with at least 30 days' notice, before we take any payment.
4. Public data sources
4.1 These public bodies are not our processors. We use their public services to obtain information you ask the Platform to look up:
| Source | What we use it for | What we send |
|---|---|---|
| Companies House (public register API) | Finding a company and filling in its profile when you add it to your Account | The company name or number you search for |
| HMRC (public "Check a UK VAT number" service) | Checking that a VAT number you enter is valid | The VAT number you enter |
4.2 Earnly does not file anything with HMRC or Companies House and does not send them any other data about you.
5. Finexer explained
5.1 Finexer Ltd (company number 12191948, registered office 124 City Road, London, EC1V 2NX) is authorised by the Financial Conduct Authority as an Authorised Payment Institution (Firm Reference Number 925695). Earnly Limited (FRN 1058277) is registered on the Financial Services Register as an agent of Finexer Ltd, which is authorised and regulated by the Financial Conduct Authority under the Payment Services Regulations 2017 (Firm Reference Number 925695) for the provision of account information services. You can check this on the Financial Services Register at register.fca.org.uk. Earnly is not itself authorised by the Financial Conduct Authority. Earnly does not provide payment initiation services, cannot initiate payments or move money, and never receives, sees or stores your online banking credentials.
5.2 Finexer has two data protection roles:
5.2.1 it is an independent controller for the account information consent journey, the authoritative consent and audit record, security and fraud prevention, and its own regulatory complaints. For these, Finexer decides how your data is used, under its own privacy notice at https://finexer.com/legal/privacy and its end user terms at https://finexer.com/legal/end-user-terms; and
5.2.2 it acts as our processor when it delivers Open Banking Data to us, under Finexer's data processing agreement.
5.3 Earnly is an independent controller of the Open Banking Data it receives and processes to provide the Platform.
5.4 Finexer's access is limited to account details, balances and transactions. You can contact Finexer about your personal data at privacy@finexer.com, and Finexer's ICO registration number is ZB841505. The Open Banking Consent Notice explains the connection in full.
6. Changes to this list
6.1 We will publish any new provider, or any change to a provider's service, data, location or safeguard, on this page at least 30 days before it takes effect. The "Last updated" date at the top shows when the list last changed.
6.2 Business Users who ask for notifications will also receive an email at least 30 days before each change. To ask for notifications, email privacy@earnly.co.uk with the subject "Sub-processor notifications". Any user may ask for them.
6.3 We will give less than 30 days' notice only where a change is needed urgently to keep the Platform secure or available, or to comply with the law. In that case we will publish the change as soon as we can and explain why.
6.4 Objecting. If you object to a change, tell us at privacy@earnly.co.uk and we will discuss your concern. Because the same providers run the Platform for every user, we cannot use a different provider for one Account. If your concern is not resolved, you can object by closing your Account before the change takes effect, free of charge. You can export your transactions as a CSV file before you close it. Closing your Account is handled as described in the Privacy Policy.
6.5 Before we use any new AI provider, or send an AI model any personal data beyond that described for Anthropic in section 3, we will complete a data protection impact assessment, give at least 30 days' notice, use only a provider that is contractually prohibited from training on Earnly user data and that limits its routine retention of that data to no more than 30 days, and update this list, the Privacy Policy and the AI Policy.
7. Contact
7.1 Data Protection Lead: Adam Marsh, Director, privacy@earnly.co.uk
7.2 Post: Earnly Limited, 41 New Cross Street, Swinton, Manchester, England, M27 4TU
7.3 You can ask for a copy of the transfer safeguards for any provider by emailing privacy@earnly.co.uk. We may remove commercially sensitive terms. You can complain to us using the "How to complain" section of the Privacy Policy, or to the Information Commission (ICO) at ico.org.uk or on 0303 123 1113.