Sub-Processors
Every party that handles personal data on our behalf, what each one does, where it operates and the instrument that covers the transfer.
1. What This Page Is
This is the complete list of our sub-processors. It is not a sample, an illustration or a set of categories. Every party that processes personal data on our behalf is named on it, and a party that is not named on it does not process personal data on our behalf.
We publish this page because a list a reader cannot enumerate answers nothing. If you find a party handling data for us that is absent from this page, tell us at ror@blacksnowintel.com and we will correct it.
2. The Sub-Processors
| Sub-Processor | What It Does For Us | Country Of Operation |
|---|---|---|
| Vercel Inc. | Application hosting and content delivery for this website and the BSI Calculator | United States, serving from Ireland |
| Supabase, Inc. | Database and file storage for calculator results, sign-up records and correspondence records | United States, serving from Ireland |
| Anthropic PBC | Large language model services used in research work | United States |
| OpenAI OpCo, LLC | Large language model services used in research work | United States |
| DataRep | Our representative in the European Union under Article 27 of the GDPR, receiving and forwarding correspondence from data subjects and supervisory authorities | Ireland |
| DataRep UK | Our representative in the United Kingdom under Article 27 of the UK GDPR, on the same terms | United Kingdom |
Six parties, and no others.
3. Where The Data Sits
The website and the database are hosted in Ireland. The application runs in the Dublin region and the database runs in the Ireland region, so records created by this website are stored in Ireland.
Research inputs are transferred to the United States, where Anthropic and OpenAI operate their model services.
Correspondence addressed to our representatives is stored in Ireland and in the United Kingdom by the two parties named for that purpose.
4. The Transfer Instruments
Every party on this page is covered by the European Commission's Standard Contractual Clauses, and by the International Data Transfer Addendum to those clauses for personal data leaving the United Kingdom.
We do not rely on the Data Privacy Framework, and we do not rely on an adequacy decision, for any transfer on this page. We name the instrument we actually use rather than the strongest one available to us.
A transfer impact assessment is completed before a new party is engaged, and the outcome is recorded.
5. What We Do Not Use
We use no advertising network, no analytics provider, no data broker, no contact-list vendor and no customer-relationship platform that receives personal data from this website. We hold no payment card data on this website, so there is no payment processor on this list.
There is no email provider on this list. Our mailboxes are not yet in service; when one is engaged its provider will be added to this page before the mailbox carries any personal data.
6. Notice Of Change, And Your Right To Object
We give 30 days notice before a new sub-processor begins processing personal data. Notice is given by publishing the change on this page with a new version number and date, and by writing to every client under contract.
A client may object to the appointment of a new sub-processor during that period, in writing, on reasonable grounds relating to data protection. Where an objection cannot be resolved, the client may terminate the affected service without penalty.
Removals are published on the same terms. Where a party leaves this list we say so, rather than deleting the row.
7. How We Contract With Them
Every party on this page is engaged under a written contract that binds it to the obligations of Article 28 of the GDPR: to process personal data only on our documented instructions, to keep it confidential, to apply appropriate technical and organisational measures, to engage no further sub-processor without authorisation, to assist us with data subject requests, and to delete or return the data at the end of the engagement.
Our own commitments to clients are set out in our Data Processing Terms, and what we collect and why is set out in our Privacy Notice.
8. Change Record
| Version | Date | Change |
|---|---|---|
| 1.0 | 17 August 2026 | First publication. Six parties named. |
9. How To Reach Us
Write to ror@blacksnowintel.com, or to Khufu Management Pty Ltd, 38 Miles Platting Rd, Eight Mile Plains, QLD 4113. In the European Union and the United Kingdom you may write to our representatives at datarequest@datarep.com, quoting BlackSnow Intelligence.
Our other published documents are indexed on the Legal page.