Legal
Data processing and subprocessors
Who touches your data on our behalf, what they do with it, and where. Written for the person at your organisation who has to sign this off.
Last reviewed
Roles
For your account and contact details, No Fear Tech Ltd (company number 16758357, 6 Mallard Way, Dereham, Norfolk NR19 1FJ) is the controller. For the website and search performance data we process to provide the service, we act as processor on your instructions, and you are the controller.
A data processing agreement is available to you on request.
Subprocessors
| Purpose | What it handles | Region |
|---|---|---|
| Hosting, storage and scheduled work | Serving the application; account records, site configuration, findings, encrypted integration tokens; crawls, analysis and scheduled work. Runs on servers operated by No Fear Tech Ltd itself, not a SaaS subprocessor | Germany (EEA); UK adequacy regulations cover the transfer |
| AI model provider — Anthropic | Page content and finding context sent for analysis, explanation and drafting. Anthropic does not train models on this data under its commercial terms | United States; transfer safeguard: Anthropic's data processing addendum incorporating standard contractual clauses |
| Transactional email — Resend | Email address and message content for service email (sign-in links, approval and notification emails) | United States; transfer safeguard: Resend's data processing addendum incorporating standard contractual clauses |
What is sent to AI providers
This is the question most worth asking, so it gets a direct answer. To analyse and explain findings we may send page content, page metadata, search queries and performance figures, and your business context. We do not send account credentials, integration tokens, or payment details.
Every provider we use contractually does not train its models on your data, and that commitment is stated per provider above.
What never leaves
- Integration tokens and CMS credentials, which are encrypted at rest and never sent to a model.
- Passwords, which are not stored in recoverable form.
- Payment details, which are handled by the payment provider.
Changes to this list
We will notify account holders before adding or replacing a subprocessor, with enough notice to object. Changes will be dated on this page.
Related
See the privacy notice for retention periods and your rights, the security page for controls, and the terms for the contractual position.