Spreeflo uses a small number of third-party providers to deliver the platform. Each one is contractually bound to data protection terms no less protective than those we give you, and we remain fully responsible for their performance.
Infrastructure and delivery#
| Provider | What they do | Data processed | Location |
|---|---|---|---|
| Amazon Web Services | Application hosting, database storage, backups | All customer data | United States |
| Amazon SES (AWS) | Outbound email delivery | Contact identifiers, message content, delivery and engagement data | United States |
| Cloudflare | Routes the branded link domains used in your email, so click-through URLs carry your domain rather than ours | Recipient IP address and the link URL at the moment of click. No contact records, attributes or message content | Global anycast edge |
Cloudflare stores none of your contact data. It is listed because, as the proxy for those link domains, it briefly processes the recipient's IP address when a link is clicked. Cloudflare is certified under the EU-US Data Privacy Framework and its UK Extension.
AI features#
AI features are optional. With them disabled, no customer data is sent to any AI provider.
Personalised message generation runs on your own API key. You supply the key, the request goes to your provider under your own agreement with them, and they act as your processor rather than our sub-processor. Where that provider is OpenAI, the contracting entity for EEA, Swiss and UK customers is OpenAI Ireland Ltd, its DPA is accepted by click-through, and it does not use API data for training by default. If you don't supply a key, the feature is off and no data goes anywhere.
The in-app AI assistant runs on Fireworks.ai, Inc. (Redwood City, California, USA). Fireworks is contractually prohibited from using your data to train or fine-tune any model, does not retain prompts or outputs beyond the request, and holds SOC 2 Type II, ISO 27001, ISO 27701 and ISO 42001 certifications. Its own sub-processor list is available on request. Prefer your own provider? Supply your own API key and we won't use Fireworks for your workspace.
Not sub-processors#
Stripe processes billing and payment data for your Spreeflo subscription. It does not process the contact data you store in Spreeflo, and is covered by our Privacy Policy rather than by our DPA.
International transfers#
Spreeflo Ltd is established in the United Kingdom. Transfers from the EEA to the UK rely on the European Commission's adequacy decision for the United Kingdom, adopted 19 December 2025 and valid until 27 December 2031.
Onward transfers to providers outside the UK and EEA are covered by the EU Standard Contractual Clauses together with the UK International Data Transfer Addendum, and, where the provider is certified, by the EU-US Data Privacy Framework and its UK Extension.
Change notifications#
We give 30 days' notice before a new sub-processor begins processing your data.
Get sub-processor change notices
We email subscribers at least 30 days before a new sub-processor begins processing customer data, as required by Clause 6.3 of our Data Processing Agreement. You do not need a Spreeflo account to subscribe.
If you object to a new sub-processor on reasonable data protection grounds, contact privacy@spreeflo.com within the notice period. Your rights on objection are set out in Clause 6.4 of our Data Processing Agreement.
Questions: privacy@spreeflo.com Spreeflo Ltd, registered in England and Wales no. 16068434, 405 Baltic Quay, 1 Sweden Gate, London, England, SE16 7TJ