Legal
Sub-Processors
Media Track Limited · Company No. 16249153 · ICO Registration ZB963026
Effective: 14 October 2026 · Version 1.2
This page lists the third-party sub-processors that Media Track Limited (“Mediatrack”, “we”, “us”, “our”) engages to process personal data, as referenced in our Privacy Notice and the Mediatrack Platform Data Processing Addendum.
For each sub-processor we show the processing it performs on our behalf, the country in which the data is processed and, where data can leave the UK, the safeguard that applies.
Current sub-processors
Used for every site
| Sub-Processor | What it does | Data it receives | Location | Transfer safeguard |
|---|---|---|---|---|
| Vercel Inc. | Hosting | Every page visit and every form submission passes through its London servers on the way to our database: the visitor’s IP address, the pages they view and the full form contents. It does not keep or use the data beyond short-lived system logs. | London | N/A |
| Supabase Pte. Ltd. | Database | The full lead (name, phone, email, postcode and form answers), page visit records (pages, timings and the last question reached, never the answers or the IP address) and call recordings. | London (eu-west-2) | N/A |
| Amazon Web Services | Data centres underneath Vercel and Supabase only | Only the data held by Vercel and Supabase, as listed above. We do not send it anything directly. | London (underlying Vercel and Supabase) | N/A |
| Web fonts on every page, address lookup where a form has one, and staff email | Web fonts: the visitor’s IP address and browser details (no form data). Address lookup: the postcode typed in. Staff email: lead alert copies and the weekly lead list (name, email, phone, address and postcode) end up in staff mailboxes. | Outside the UK possible | UK transfer safeguards apply (see below) | |
| Tailwind Labs | Styling file loaded on every page | The visitor’s IP address and browser details, nothing else. | Outside the UK possible | UK transfer safeguards apply (see below) |
| Sentry | Error monitoring | Technical error reports, including the page address. If an error happens while a lead is being handled, the report can include the lead’s details. | Outside the UK possible | UK transfer safeguards apply (see below) |
| Resend | Email sending | Lead alert emails, only where a client switches alerts on: the lead’s name, phone, email, postcode and form answers, including any injury answers (a copy goes to a Media Track inbox). The weekly lead list: name, email, phone, address and postcode, no answers. Call-back request emails: the caller’s name and phone number. | Outside the UK possible | UK transfer safeguards apply (see below) |
Only where the feature is used
| Sub-Processor | What it does | Data it receives | Location | Transfer safeguard |
|---|---|---|---|---|
| Twilio Inc. | Call tracking | The tracking phone number, the call itself and the recording. The caller’s number and the call audio pass through it. The recording is copied to our London database and then deleted at Twilio. Applies only where call tracking is enabled for the client’s page. Recordings we hold are deleted after 90 days. | Outside the UK possible | UK transfer safeguards apply (see below) |
| Vapi | AI phone receptionist: answers when the client does not pick up or outside office hours | It hears the whole call and saves the caller’s name, number, answers and a transcript. Applies only where the AI receptionist is switched on for the client’s page. Vapi may hold its own copy under its own settings. | Outside the UK possible | UK transfer safeguards apply (see below) |
| OpenAI (via Vapi) | The receptionist’s language model | What is said on receptionist calls. It is not used for training. | Outside the UK possible | UK transfer safeguards apply (see below) |
| Voice and speech-to-text providers (via Vapi) | Turn the receptionist’s replies into speech and transcribe the caller (providers being confirmed) | The call audio and text. | Outside the UK possible | UK transfer safeguards apply (see below) |
| Unsplash | Stock images loaded on some pages | The visitor’s IP address and browser details, nothing else. | Outside the UK possible | UK transfer safeguards apply (see below) |
| FLG360 | CRM and lead routing, only where a client’s leads are routed through FLG | The full lead: name, phone, email, postcode and form answers. | UK | N/A |
What changed in this version
- Version 1.2 (14 October 2026): Twilio and Vapi entries now say they apply only where call tracking or the AI receptionist is switched on for the client, and state the 90-day recording deletion and that Vapi may hold its own copy.
- Version 1.1 (14 October 2026): each entry now states exactly what data the supplier receives; hosting is London; added Amazon Web Services (underlying only), Tailwind, Sentry, Resend, Vapi, OpenAI (via Vapi), voice and speech-to-text providers (via Vapi) and Unsplash; removed Zapier (nothing uses it); Google now covers fonts, address lookup and staff email; Twilio, Vapi, OpenAI, voice and speech providers, Unsplash and FLG360 are marked as applying only where the feature is used.
- Anywhere a client asks us to send its leads (such as the client’s own system) receives them on the client’s instructions and is not our sub-processor.
Transfer safeguards
Where a sub-processor processes personal data outside the UK, we rely on appropriate safeguards under UK data protection law — the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses (“SCCs”), or, for transfers to the United States, the UK Extension to the EU-US Data Privacy Framework (the “UK-US Data Bridge”) — together with supplementary measures as appropriate.
Changes to this list
We may add or replace sub-processors from time to time. When we do, we will update this page, and the “Effective” date above shows when it was last updated. Customers with a Data Processing Addendum in place will be notified of changes in accordance with its terms.
Contact
If you have any questions about our sub-processors or international data transfers, contact our Data Protection Officer at racheal@mediatrack.ai or by post to Data Protection Officer, Media Track Limited, 167-169 Great Portland Street, 5th Floor, London, W1W 5PF.