Sub-processors
Last updated: 27 September 2026
Round Monster engages the third parties listed below as sub-processors to deliver parts of the platform. Each one is contractually bound by data-protection obligations no less protective than those in our Data Processing Agreement.
This page is the canonical list. Whenever a sub-processor is added or replaced we will email every account owner at least 30 days before the change takes effect, so that the Controller has a reasonable window to object on data-protection grounds (see clause 7 of the DPA).
Core platform sub-processors
These are the providers that are integral to the running of Round Monster. The Controller cannot opt out of them while continuing to use the platform.Supabase, Inc.
- Service: Hosted Postgres database, authentication, edge functions, storage buckets.
- Data processed: all Customer Data (see DPA clause 3) — this is where the Controller's primary data lives.
- Processing location: European Union (Frankfurt, Germany) on AWS.
- Safeguards: Supabase's DPA, GDPR-compliant infrastructure, encryption at rest and in transit, row-level security enforced per tenant.
- Website: https://supabase.com
Postmark (a brand of ActiveCampaign, LLC)
- Service: Transactional email delivery (account confirmations, password resets, invoices, reminders, payment receipts and other in-app emails sent on the Controller's behalf).
- Data processed: sender + recipient names and email addresses, email subject and body, delivery / open / click metadata.
- Processing location: United States (with UK / EU-equivalent transfer safeguards in place).
- Safeguards: Postmark's DPA + Standard Contractual Clauses.
- Website: https://postmarkapp.com
Stripe Payments UK Ltd
- Service: Card-payment processing for the Controller's subscription to Round Monster, and (where the Controller has enabled it) for collecting the Controller's end-customer payments.
- Data processed: billing contact details, payment-card metadata (last four digits, brand, expiry — full card numbers are tokenised by Stripe and never reach Round Monster), transaction amounts, currency, status.
- Processing location: United Kingdom and European Economic Area, with onward transfers to the United States under SCCs.
- Safeguards: Stripe's DPA, PCI-DSS Level 1 certification.
- Website: https://stripe.com
ClickSend Pty Ltd
- Service: Outbound and inbound SMS messages sent from / received by the Controller's account.
- Data processed: sender + recipient phone numbers, message content, timestamp, delivery status.
- Processing location: United Kingdom routing for UK-originating traffic; global infrastructure for international messages.
- Safeguards: ClickSend's DPA, Standard Contractual Clauses for non-UK / non-EEA transfers.
- Website: https://www.clicksend.com
GoCardless Ltd
- Service: Direct Debit collection for the Controller's end-customer invoices (where enabled by the Controller).
- Data processed: end-customer name, address, email, sort code + account number (entered directly into GoCardless), payment amounts, mandate status.
- Processing location: United Kingdom.
- Safeguards: GoCardless's DPA, FCA-regulated payment institution.
- Website: https://gocardless.com
EmailOctopus Ltd
- Service: Marketing-email delivery for opt-in audiences only (where the Controller chooses to use the marketing module).
- Data processed: recipient name, email, subscription status, campaign engagement metadata.
- Processing location: United Kingdom and United States (with SCCs in place).
- Safeguards: EmailOctopus's DPA.
- Website: https://emailoctopus.com
Optional integrations the Controller may enable
The following providers are not automatic sub-processors. They only receive Customer Data if the Controller actively connects an account through the in-platform integration settings. When the Controller does so, the relationship between the Controller and the integration provider is governed by the provider's own terms and privacy policy, not by this DPA — Round Monster acts only as the technical conduit.- QuickBooks Online (Intuit Inc.): two-way accounting sync. Data shared: customers, invoices, payments. quickbooks.intuit.com/uk
- Xero Limited: two-way accounting sync. Data shared: customers, invoices, payments. xero.com
- FreeAgent Central Ltd: two-way accounting sync. Data shared: customers, invoices, payments. freeagent.com
Ancillary services with no Customer Data access
The platform also calls a small number of third-party services that do not process Customer Data on Round Monster's behalf. They are listed here for transparency:- Have I Been Pwned (Superlative Enterprises Pty Ltd): queried at sign-up and password change to reject passwords known to have appeared in public breach corpora. Round Monster sends only the first 5 hexadecimal characters of an SHA-1 hash of the candidate password (k-anonymity); no email address, username or other personal data is transmitted. haveibeenpwned.com
- ipify (Andrey Petrov): queried client-side at sign-up and at re-acceptance of legal documents to record the Controller's IP address in the clickwrap audit row. Returns only the caller's public IP. ipify.org
- postcodes.io (Ideal Postcodes Ltd): UK postcode → coordinates lookup used to geo-code customer addresses, depots and the dashboard weather location. The platform sends only the postcode being looked up; no customer name, address or other personal data is transmitted. Data is the Office for National Statistics Postcode Directory (Open Government Licence v3.0). postcodes.io
- WeatherAPI.com (Bhavik Patel, trading as WeatherAPI): 3-day weather forecast displayed on the operator dashboard. The platform sends only the latitude and longitude configured in Settings → Company → Weather Location (operator chooses these); no customer data is transmitted. The dashboard weather widget is powered by WeatherAPI.com, used under their free-tier terms of service.
- DVLA Vehicle Enquiry Service (Driver & Vehicle Licensing Agency): optional vehicle look-up used when an operator adds or edits a fleet vehicle. When the operator clicks "Look up", the platform sends only the vehicle registration number being queried to the DVLA — no customer name, address or other personal data is transmitted. The registration is sent in the request body (never a URL) in line with ICO guidance, and the response (make, colour, fuel, engine size, tax status) is cached server-side for up to 24 hours. DVLA Vehicle Enquiry Service, used under the Open Government Licence v3.0.
- DVSA MOT History API (Driver & Vehicle Standards Agency): optional vehicle look-up used alongside the DVLA service when an operator adds or edits a fleet vehicle, or refreshes Fleet Health. The platform sends only the vehicle registration number being queried to the DVSA — no customer name, address or other personal data is transmitted. The response (make, model, MOT expiry date, odometer readings and MOT test history) is cached server-side for up to 24 hours. DVSA MOT History API, used under the Open Government Licence v3.0.
- CARTO (CARTO DB Inc.) basemap tiles: visual map tiles for every map view in the platform (Day Map, worksheet maps, route planner). The platform fetches static tile images by zoom / x / y coordinate; no Round Monster customer data is sent — tile requests carry only the area of the map currently visible. Underlying map data is © OpenStreetMap contributors (Open Database License). carto.com/basemaps
- Leaflet.js (Volodymyr Agafonkin) and Leaflet.markercluster (Dave Leaver): open-source JavaScript libraries (BSD-2 / MIT) bundled into the operator dashboard for rendering the maps client-side. No data leaves the user's browser to either project.