Sub-processors
Last updated: 9 November 2026
1. What this page is
StableSync is operated by Mettux Ltd (company number 17497743, England and Wales). When your yard uses StableSync, your yard is the data controller for the people and horses it records, and Mettux Ltd is your data processor. To run the service we rely on a small number of other companies, called sub-processors. This page lists every one of them, what it does for you, what data it handles and where that data is held.
The list below is drawn from how the software actually works. We only use a sub-processor where the service cannot work without it, or where your yard has chosen to use a feature that needs one. We do not use advertising or analytics services.
This page forms part of our Data Processing Agreement and our Privacy Policy.
Transfers to sub-processors in the United States are made under the UK Extension to the EU–U.S. Data Privacy Framework where the provider is certified, and otherwise under the UK International Data Transfer Addendum in that provider's data processing terms.
2. Sub-processors used for every yard
These services are part of running StableSync. Every yard's data passes through or is stored with them.
| Sub-processor | What it does | Personal data involved | Where |
|---|---|---|---|
| Vercel Inc. | Hosts the website and the application, runs its code and its scheduled jobs (reminders, invoicing, backup export, deletions) | All data handled by the application while a request is processed; your IP address and country while you use the service | London, United Kingdom (region lhr1) |
| Neon Inc. | Hosts the databases. Each yard has its own separate database; a small central registry holds yard accounts | Everything your yard records: people, horses, bookings, rotas, invoices, messages, audit logs | London, United Kingdom (AWS eu-west-2) |
| Cloudflare, Inc. | Stores uploaded files (documents, photos, logos) in Cloudflare R2, and a nightly copy of each database that is encrypted before it is stored. Files are only served through the application after a sign-in and permission check | Uploaded documents and photos, which may contain personal data (for example a passport scan or an invoice PDF); the encrypted database copies | Cloudflare network; the bucket's location is set in our Cloudflare account |
| Resend, Inc. | Sends the emails the service sends: invitations, password resets, notifications, reminders and alerts | Recipient email address and name, and the content of each email | European Union (Ireland) |
| Stripe | Takes subscription payments and, where a yard uses it, card payments of livery invoices through Stripe Checkout and the Stripe customer portal. When a yard connects its own Stripe account (Stripe Connect, not yet switched on), its clients pay the yard directly, and Stripe collects the yard owner's identity and bank details for its own checks as an independent controller | Yard owner's name and email, yard name; for invoice payments the payer's email. Card details are entered on Stripe's pages and never reach StableSync | Stripe Payments Europe Ltd (Ireland) with Stripe, Inc. (United States) |
| Sentry (Functional Software, Inc.) | Collects error reports from the application's servers so we can fix faults. No performance tracing, no session recording, and no error reporting from your browser | Technical details of an error: the page or request address, the yard's subdomain and the error message. No cookies, passwords or form contents are sent | European Union (Germany data region) |
| GitHub, Inc. (Microsoft) | Runs the nightly database backup and keeps the encrypted backup set for 35 days. Backups are encrypted before they are stored, with keys held only by Mettux Ltd's directors; GitHub cannot read them | An encrypted copy of every database. During the backup run itself the copy is briefly unencrypted on the backup machine before it is sealed | United States |
| ImprovMX | Forwards email sent to our hello@ and admin@ addresses to our mailboxes | The sender's address and the content of any email you send us | France (ImprovMX SAS) |
3. Sub-processors used only for features you choose
These services are only involved when a person or a yard uses the feature. Your yard owner can switch off translation, reading photos, smart search and answers from your records for the whole yard in Settings → Outside services; nothing is sent while a switch is off. Answers from your records is off until the owner switches it on.
| Sub-processor | What it does | Personal data involved | Where |
|---|---|---|---|
| Google LLC | “Sign in with Google”, if you choose it | Your Google account email and name, passed to us when you sign in | United States |
| Meta Platforms | “Sign in with Facebook”, if you choose it | Your Facebook account email and name, passed to us when you sign in | Meta Platforms Ireland Ltd (Ireland) and Meta Platforms, Inc. (United States) |
| Browser push services (Google, Apple, Mozilla) | Deliver browser notifications to a device where you have turned them on. The notification text is encrypted in the browser's push system, so the push service cannot read it | A device address issued by your browser, and the encrypted notification | United States |
| DeepL SE | Translates text a person asks to see in another language (yard switch: “Translation”) | The text being translated, which may contain names or other personal details if they are in that text. Translations are cached so each text is sent once | European Union (Germany) |
| Open-Meteo | Weather forecasts for the grazing, rug and laminitis-risk features (the home page's rug guide calls it from your browser instead: see section 4) | None. Our server sends only the yard's map coordinates; no names, accounts or horses | European Union |
| Anthropic PBC | Three optional features, each with its own yard switch:
| The photo uploaded; the search question typed; for answers, the question, the name of the person asking and the records needed to answer it. That can be any record the person may see: horse details, care and health records, weights, turnout and rugs, feed, staff shifts and leave, bookings, tasks, invoices and balances, messages, notices, service requests, the hacking board, consent status, documents, and the contact details of the yard's vets, farriers and other providers. Emergency contacts are sent as name and relationship only, never phone number or email; medicines only where the person may see them | United States |
4. What is not on this list
- Fonts are bundled with the site when it is built, so your browser does not contact Google Fonts.
- OpenStreetMap map tiles on the bridle paths page. Your browser fetches them directly, so the OpenStreetMap Foundation sees your IP address when you open that page; nothing about your yard is sent.
- The place search when you set your yard's location, or try another place on the demo yard. Your browser sends what you type to OpenStreetMap's Nominatim service, so the OpenStreetMap Foundation sees that text and your IP address; nothing else about your yard is sent.
- The rug guide on our home page. Your browser asks Open-Meteo for tonight's forecast, so Open-Meteo sees your IP address and a rough location (to about 10 km). That location comes from your IP address through our server, which keeps no record of it.
- Your browser's own speech recognition, when you use the microphone button on a note. Depending on the browser this may use Google's, Apple's or Microsoft's speech service under their own terms. StableSync never receives the audio, only the text you save.
- Vercel's and Neon's management tools, which we use to set up a yard's address and database. They see the yard's subdomain and database name, not its contents.
- Tools we use on our own computers to research the feed catalogue. They never see yard data.
- Your vet, farrier or other providers you choose to share a horse's records with. They act on your yard's instructions, not ours.
5. Changes to this list
If we plan to add or replace a sub-processor, we will update this page and email every yard owner at least 30 days before the change takes effect. If a yard has a reasonable, data-protection reason to object, it can tell us within that time; we will try to find a solution and, if we cannot, the yard may end its subscription for the affected feature or for the service without penalty, as set out in the Data Processing Agreement.
Removing a sub-processor, or a change that does not affect how your data is handled, is reflected here without notice. The “Last updated” date at the top shows when this page last changed.
6. Contact
Questions about any of these companies, or about where your data is held: email [email protected].