Last updated: 24 September 2026
Straduct uses selected third-party service providers to help host, operate, secure and deliver our website, application, research and AI-assisted services.
This page provides information about those providers, the purposes for which they may process information and Straduct's approach to data processing and subprocessors.
It should be read together with our Privacy Notice, Security information and AI & Human Review Policy.
The role Straduct performs under data protection law depends on the relevant processing activity.
For activities such as managing user accounts, operating our website, providing support, securing our systems and managing our own business operations, Straduct may act as a data controller.
Where a customer provides personal data to Straduct and instructs Straduct to process that information solely on its behalf, Straduct may act as a data processor and the customer may act as the data controller.
The correct role is determined by the nature and circumstances of the particular processing activity.
Where Straduct acts as a processor on behalf of a customer and applicable data protection law requires a processor agreement, the relevant processing should be governed by a Data Processing Agreement (“DPA”).
A DPA may address matters including:
This webpage is provided for transparency and does not itself replace a Data Processing Agreement where one is legally required.
A subprocessor is a third-party service provider engaged by a processor to process personal data in connection with services provided to a customer.
Not every supplier used by Straduct will necessarily act as a subprocessor in every context. The classification depends on the service provided and the relevant processing activity.
The following providers are currently used within Straduct's website or application infrastructure and may process information depending on the feature being used.
| Provider | Purpose | Typical data involved |
|---|---|---|
| Vercel | Application hosting, deployment and delivery infrastructure for app.straduct.com | Application requests, technical and operational information and data necessary to deliver the application |
| Supabase | Database, backend infrastructure and related application services | Account, workspace, business, research, evidence and application data as required by the relevant feature |
| Brevo | Transactional and service email delivery | Email address, recipient name where applicable, delivery information and message content |
| Anthropic | AI-assisted analysis and intelligence functionality where applicable | Prompts, selected research material, evidence, business context or other information necessary to provide the requested AI functionality |
| Google / Gemini | Deep Research and AI-assisted research functionality where applicable | Research queries, selected business or market context, source material and information necessary to carry out the requested research |
| BanaHosting / Sitejet | Public website hosting, delivery and website management infrastructure for straduct.com | Website requests, technical information, server logs and information submitted through website functionality where applicable |
A provider listed above may perform different legal roles depending on the specific service, configuration and processing activity.
Straduct may use external AI providers to perform specific AI-assisted functions.
Depending on the feature being used, information transmitted to an AI provider may include:
Straduct aims to limit information transmitted to external AI providers to information reasonably necessary for the relevant function.
Additional information about AI use is available in our AI & Human Review Policy.
Where supported, Straduct may allow a workspace administrator to choose between platform-managed AI and a customer-managed AI arrangement.
With platform-managed AI, Straduct selects and manages the relevant provider relationship.
Where customer-managed AI is supported, a customer may use its own provider account, credentials, private endpoint or another supported configuration.
In a customer-managed arrangement, the customer may have a direct contractual relationship with the relevant AI provider and should review that provider's terms and data-processing arrangements.
Some service providers may process information outside Ireland or the European Economic Area.
Where personal data is transferred internationally, Straduct will use or rely on an appropriate transfer mechanism where required by applicable data protection law.
Such mechanisms may include:
Additional technical, contractual or organisational safeguards may be used where appropriate.
Straduct aims to use service providers that provide appropriate technical and organisational safeguards for the nature of the processing they perform.
Relevant considerations may include:
Further information about Straduct's security approach is available on our Security page.
Where a provider acts as a subprocessor in connection with customer personal data, Straduct aims to ensure that appropriate data protection obligations apply to that provider.
Where required under an applicable DPA, Straduct will maintain appropriate mechanisms concerning the appointment or replacement of subprocessors.
Straduct's infrastructure and providers may change as the platform develops.
Providers may be added, replaced or removed to improve functionality, reliability, security, performance, cost efficiency or compliance.
This page will be updated when material changes are made to the providers relevant to the processing described here.
Where a customer agreement or DPA requires advance notification of new subprocessors, Straduct will provide notification in accordance with that agreement.
Straduct may introduce third-party payment processing for subscriptions and pay-per-run services.
The relevant payment provider will be added to this page before payment functionality is made available where that provider processes personal data in connection with Straduct.
Payment card information may be collected and processed directly by the payment provider rather than stored by Straduct.
Customers remain responsible for determining whether their use of Straduct complies with their own legal, regulatory and contractual requirements.
Customers should assess whether a DPA, data protection impact assessment, transfer assessment or other internal review is required for their particular use of Straduct.
Information about how Straduct processes personal data and how individuals can exercise applicable privacy rights is available in our Privacy Notice.
Questions about Straduct's data processing arrangements or service providers may be sent to:
Straduct
Email:
support@straduct.com
Website:
straduct.com