Sub-processors

This page lists current sub-processors used by WFA Support Ltd to provide Straight2PDF. It supports our Data Processing Agreement and Privacy Policy.

Sub-processor	Purpose	Location/transfer	Data involved
24host.uk	Hosting and infrastructure for the core web platform and customer service data.	United Kingdom.	Platform data, customer account data, form/submission data, generated files and operational logs, including a nightly backup copy kept on a separate 24host.uk server in the UK for 30 days.
Stripe (Stripe Payments UK Ltd and its affiliates)	Card payments, subscriptions, add-ons, top-up purchases, invoices and receipts.	United Kingdom, EU and US (Stripe group), under Stripe's transfer safeguards.	Billing contact name and email, company name, billing address, VAT details, subscription and payment records. Card details are entered directly with Stripe; Straight2PDF never sees or stores full card numbers.
Microsoft Corporation (Microsoft 365)	Sending service emails, such as sign-in codes, notifications, form PDFs and reports.	UK/EU, with possible transfers to the US under Microsoft's safeguards.	Recipient email addresses, email content and any attached PDFs.
Twilio Inc.	Sending text-message sign-in codes, where a user chooses text-message two-factor authentication.	US. Messages are delivered through the mobile network of the recipient's phone.	Mobile phone number and the sign-in code message.
Functional Software, Inc. (Sentry)	Crash and error reporting for the mobile app.	EU (Germany) data region.	Technical error details, device model, operating system version and app state at the time of the error.
Anthropic PBC	The optional AI Assistant: building and changing forms and rules, and summarising submitted answers, only when a customer's authorised users choose to use it. Summaries only when the customer has switched them on.	US.	What the user types or uploads, the design of the form concerned, and for summaries the written answers of the submissions chosen (never photos, signatures, drawings, email addresses, phone numbers or who submitted). Not stored by Straight2PDF after the result is shown.
Google LLC	Google Play app distribution and related platform services for Android users.	US/International.	App store account, device, install and platform metadata handled by Google. Customer form content is not shared with Google for app distribution. Google acts as an independent controller for its app store.
Apple Inc.	App Store/iOS-related distribution and platform services for iOS users.	US/International.	App store account, device, install and platform metadata handled by Apple. Customer form content is not shared with Apple for app distribution. Apple acts as an independent controller for its app store.
OpenStreetMap Foundation (map tiles)	Background maps on the admin Submission Location Map. An independent provider rather than a processor acting on our instructions.	UK-based foundation; tiles served worldwide through its content delivery network.	The admin user's IP address and browser details, and which map areas are viewed, which can show roughly where submissions were made. No form content is sent.

Transfers outside the UK

Where a provider processes data in the US, the transfer relies on the UK Extension to the EU-US Data Privacy Framework where the provider is certified, or otherwise on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses in the provider's data processing terms.

Changes to sub-processors

We list every change to this page below, with its date. To be emailed when a sub-processor is added or replaced, ask us at privacy@straight2pdf.co.uk. If you object to a new sub-processor on reasonable data protection grounds, tell us within 30 days of the change being listed and we will discuss alternatives with you.

• 1 October 2026: Sentry's location corrected to its EU (Germany) data region. OpenStreetMap map tiles listed. Transfer safeguards and this change log added.

Questions

For questions about sub-processors, contact privacy@straight2pdf.co.uk.