Sub-processors
Last updated: 30 September 2026
To run Thankbox, we work with a number of trusted third-party companies ("sub-processors") that process personal data on our behalf. This page lists who they are, what they do and where they process data.
For more on how we handle personal data, see our Privacy Policy.
Infrastructure and hosting
| Sub-processor | Purpose | Location |
|---|---|---|
| DigitalOcean, LLC | Application hosting and managed databases | United Kingdom (London region) |
| Amazon Web Services | Storage of user-uploaded media | United Kingdom and Ireland |
| Cloudinary Ltd | Storage and processing of user-uploaded photos, videos and audio | Israel |
| Cloudflare, Inc. | Content delivery, DNS, firewall and bot protection | Global network (US company) |
| Functional Software, Inc. (Sentry) | Error and performance monitoring | United States |
| SolarWinds (Papertrail) | Application log monitoring (logs deleted after 3 days) | United States |
Payments and gifts
| Sub-processor | Purpose | Location |
|---|---|---|
| Stripe Payments Europe Ltd | Payment processing | Ireland |
| Tremendous LLC | Digital gift cards and monetary gift payouts | United States |
Email, support and communication
| Sub-processor | Purpose | Location |
|---|---|---|
| Mailgun Technologies, Inc. | Sending service emails (notifications, receipts, card delivery) | Germany and Belgium (EU) |
| Mailjet SAS | Sending marketing emails | France (EU) |
| Help Scout PBC | Customer support inbox and help centre | United States |
| Google Ireland Limited (Google Workspace) | Email correspondence with customers | Ireland / United States |
| WorkOS, Inc. | Single sign-on (SSO) for business customers | United States |
| Trustpilot A/S | Sending review invitations to customers | Denmark (EU) |
| Slack Technologies | Internal alerts & notifications | United States |
Analytics, consent and AI
| Sub-processor | Purpose | Location |
|---|---|---|
| PostHog, Inc. | Product and website analytics | Germany (EU) |
| Google Ireland Limited (Google Analytics) | Website and product usage analytics | Ireland / United States |
| iubenda s.r.l. | Cookie consent banner and consent records | Italy (EU) |
| OpenAI OpCo, LLC | AI-assisted analysis of customer data | United States |
| TypeSafe AI, Inc. | AI-assisted spam and fraud detection | United States |
| Artia International S.R.L. (ip-api.com) | Approximate location lookup from IP address | Romania (EU) |
Physical gifts and printing
These partners receive only the details needed to deliver a physical gift or card, such as the recipient's name, delivery address and phone number.
| Sub-processor | Purpose | Location |
|---|---|---|
| Lulu Press, Inc. | Printing and posting physical cards | United States |
| Bloom and Wild Limited | Flower and gift delivery | United Kingdom |
| Virgin Wine Online Ltd | Wine and gift delivery | United Kingdom |
| Kaleidosocial CIC (Social Stories Club) | Gift delivery | United Kingdom |
Changes to this list
We review this list regularly and update this page before we start using a new sub-processor. Business customers with a data processing agreement are notified of changes in line with that agreement.
Questions
If you have any questions about our sub-processors or how we handle your data, contact us at [email protected].