Sub-processor List
To provide CADVIX and the CADVIX designer, Cadvix engages third-party service providers, called sub-processors, who may process personal data on our behalf. This page lists every one of them, what each one processes and where.
Why this matters
Under the UK GDPR and the EU GDPR, when you hold information about your own clients in CADVIX, you are the controller and Cadvix acts as your processor. We are required to tell you which sub-processors we engage, and to give you the chance to object before a new one begins.
Before you read the tables
The records you keep about your own clients are held in an encrypted database on your own computer. What travels between your computers is sealed on your machine first, and neither we nor our hosting provider can read it.
Some things do reach us readable: usage counts, crash reports, the problems and ideas you send, session packages from the designer, and Cadvix AI's requests. Section 5 of our Privacy Policy describes each one and the switch that stops it. The tables below say which provider handles each.
1. Our own services
| Entity | Purpose | Location | Safeguard |
|---|---|---|---|
| Amazon Web Services EMEA SARL aws.amazon.com | Our account service, relay, Cadvix AI's cloud service, databases, object storage, key and secret storage, and the email our services send | United Kingdom, London | UK GDPR. No international transfer |
What it processes:
- Your account details: names and email addresses, passwords only as salted hashes, and sessions only as hashes.
- Your subscription, your seats and the computers approved into your business.
- The activity log, which contains identifiers only.
- Sealed parcels on their way between your computers, which we cannot read.
- Your daily usage counts.
- Cadvix AI's requests on their way to Anthropic, its record of each message with no words in it, the allowance counts, and the learning records.
- Technical request logs, which can include IP addresses.
2. The report desk
| Entity | Purpose | Location | Safeguard |
|---|---|---|---|
| Vercel Inc. vercel.com | Hosts the report desk and its functions | Hosted in London. A US company | EU-US Data Privacy Framework and its UK Extension, or SCCs with the UK Addendum |
| Supabase, Inc. supabase.com | Holds the report desk's records and files | Hosted in London. A US company | EU-US Data Privacy Framework and its UK Extension, or SCCs with the UK Addendum |
What they process: crash reports, the problems and ideas you send, and session packages from the designer, with their pictures, session logs, designs and Cadvix AI conversations, and the name and email address of the person who sent each. Both keep request logs of their own, which can include the IP address a report was sent from.
3. Artificial intelligence
| Entity | Purpose | Location | Safeguard |
|---|---|---|---|
| Anthropic, PBC anthropic.com | The model behind Cadvix AI, and the Claude model the people who work on CADVIX for us use to read reports and session packages | United States | SCCs with the UK Addendum |
What it processes: each Cadvix AI request, which carries the conversation, a picture of the design and a description of the scene, and the reports and session packages we read with Claude. Anthropic may keep requests for a limited period under its own terms, for example to check for misuse.
4. Payments
| Entity | Purpose | Location | Safeguard |
|---|---|---|---|
| Paddle.com Market Ltd paddle.com | Merchant of record: checkout, subscriptions, seat changes, invoicing and VAT | United Kingdom and Ireland | UK and EU GDPR |
Paddle is the seller of record for every purchase, and the controller of the payment information it holds. Card details are entered into Paddle's own checkout and are never received, processed or stored by Cadvix. We hold Paddle's customer and subscription references and the email address used for the purchase.
5. Email and internal work
| Entity | Purpose | Location | Safeguard |
|---|---|---|---|
| Google LLC Google Workspace | Our internal email and documents, and the report desk's two emails, from support@cadvix.com | United States | EU-US Data Privacy Framework and its UK Extension, and SCCs |
| Airtable, Inc. airtable.com | Internal operations and project tracking | United States | EU-US Data Privacy Framework and its UK Extension, and SCCs |
6. This website
These providers serve the website at cadvix.com. None of them has access to the software, to your account or to your client records. The cookie consent banner is part of the website itself and sends nothing to a third party.
| Entity | Purpose | Location | Safeguard |
|---|---|---|---|
| Amazon Web Services EMEA SARL AWS Amplify and Amazon CloudFront | Website hosting and delivery | United Kingdom, London, delivered through Amazon CloudFront's worldwide edge locations | UK GDPR. The AWS Data Processing Addendum and SCCs for edge delivery outside the United Kingdom |
| Google LLC Tag Manager and Analytics | Website analytics, only with your consent | United States | EU-US Data Privacy Framework and its UK Extension, and SCCs |
| Meta Platforms, Inc. Meta Pixel | Advertising measurement, only with your consent | United States and Ireland | EU-US Data Privacy Framework and its UK Extension, and SCCs |
7. Marketing email
| Entity | Purpose | Location | Safeguard |
|---|---|---|---|
| Kit, formerly ConvertKit kit.com | Our mailing list | United States | EU-US Data Privacy Framework and its UK Extension, and SCCs |
Kit holds the email address, and where given the name and company, of anyone who has asked to hear from us. It has no access to the software, to your account or to your client records.
8. Source code
GitHub, Inc. hosts our source code and our deployment pipeline. It does not receive customer personal data.
9. Your own accounts
Some features connect CADVIX on your computer directly to an account or a tool of your own: Google Drive for backup and for importing clients, Gmail or a Microsoft mailbox for sending quotes, your own Google or Microsoft calendar, and the tools your automations send to. These providers are your suppliers, not our sub-processors. What CADVIX sends them goes from the software on your computer straight to your own account, and does not pass through our servers. Section 7 of our Privacy Policy sets out exactly what is written, the permissions CADVIX asks for, and why.
10. Processing locations
| Location | Framework | Status |
|---|---|---|
| United Kingdom | UK GDPR and Data Protection Act 2018 | Domestic. No transfer |
| Israel, where Cadvix is established | UK and EU adequacy decisions | Adequate |
| European Union and EEA | EU GDPR | Adequate |
| United States | EU-US Data Privacy Framework, its UK Extension, and SCCs with the UK Addendum | Appropriate safeguards |
Transfers to the United States arise from Cadvix AI and the reports we read with Claude, from our internal email and documents, from website analytics and advertising measurement, and from our mailing list.
11. Changes to this list
Adding a sub-processor
We will update this page, and email the owner of every subscribing business, at least 30 days before a new sub-processor begins processing personal data. If you object on reasonable data protection grounds and we cannot resolve it, you may cancel without penalty.
When a change cannot wait
Where a provider stops its service, suffers a security incident, or must be replaced to keep CADVIX running or to meet the law, we may make the change sooner, and we will update this page and tell you as soon as we reasonably can.
Removing a sub-processor
We will update this page promptly, and ensure any personal data held by the removed provider is deleted or returned.
12. Your rights
- To be informed which sub-processors we use. This page discharges that duty.
- To object to a new sub-processor, as section 11 sets out.
- To ask for evidence of a sub-processor's compliance measures, subject to confidentiality.
13. Contact
Email: support@cadvix.com
Post: Cadvix, Edar 35, Modi'in 7177072, Israel
We aim to reply within 48 hours.
14. Change log
| Date | Version | Change |
|---|---|---|
| 22 January 2026 | 1.0 | First publication |
| 9 September 2026 | 2.0 | Rewritten to match the software as built. Amazon Web Services and CookieYes added. TikTok removed. Its tag was never correctly installed: the published tag still carried the placeholder pixel identifier it shipped with, so nothing it sent reached an account of ours. Bubble removed, as it is not used and never held client records. Microsoft Clarity and Google Ads removed, as they are not present on the site. Cloudways corrected to website hosting only. Kit corrected to marketing email only. |
| 28 October 2026 | 2.1 | CookieYes removed. The cookie consent banner is now part of this website and sends nothing to a third party. Cloudways replaced by Amazon Web Services as the website's host: the website moved to AWS Amplify in London on 20 October 2026. |
| 28 October 2026 | 3.0 | Rewritten to match the software as it now runs. Added Vercel and Supabase, which host the report desk, in use since 24 October 2026 for reports and since 27 October 2026 for session packages, and Anthropic, in use since 24 October 2026 for reading reports with Claude and since 26 October 2026 for Cadvix AI. None of the three was announced here 30 days ahead, as this list promised; this version corrects that. Added the section on your own Google and Microsoft accounts, and the email to every business owner when a sub-processor is added. Removed the statement that no product data is processed outside the United Kingdom. |