Legal

Subprocessor&PlatformProviderSchedule

Last updated: 10th July 2026 · Nathan & Brank

Nathan & Brank may use trusted third-party vendors, subprocessors, infrastructure providers, advertising platforms, AI providers, analytics tools, communications platforms and operational tools to support the delivery of its marketing, advertising, analytics, reporting, automation, client portal, campaign management, creative and related services.

These third parties may process personal data only where necessary to provide the contracted services, maintain and secure the relevant platforms, support integrations, deliver communications, manage campaigns, generate reports, provide analytics, support AI-assisted content generation and enable operational delivery.

This Schedule is intended to provide transparency about the third parties that may process, host, transmit, secure, support, analyse or integrate personal data in connection with Nathan & Brank's services.

This Schedule should be read together with Nathan & Brank's Privacy Policy, Information Security Policy, Data Processing Agreement, Terms and Conditions, and any applicable client agreement.

Classification Model

Nathan & Brank classifies third-party providers as follows:

Classification	Meaning
Core Subprocessor	A vendor Nathan & Brank controls and uses to run the platform or deliver contracted services.
Client-Authorized Platform	A third-party platform the client connects, owns, or grants access to for campaign delivery or reporting. Nathan & Brank acts as an operator on the client's behalf.
Internal Operational Tool	A tool used by Nathan & Brank staff to manage delivery, monitoring, or internal workflows.
Social Listening Source	A free or API-connected public data source used for brand mention monitoring. No personal data is processed beyond publicly available content.

Data Categories Processed

The below categories of data are processed:

Client and account data — company name, contacts, contracts, invoices, brand ownership, client portal user records
Lead and prospect data — lead source, contact details, pipeline stage, research outputs, scoring assessments, opportunity notes
Brand and creative data — brand guides, logos, assets, briefs, final deliverables, social content, ad copy
Campaign and channel data — ad account IDs, campaign names, spend, clicks, impressions, conversion data, audiences, lead form submissions
Website and analytics data — website events, search console data, session behaviour, SEO performance, GA4 metrics
Email and messaging data — email addresses, message content, campaign sends, opens, clicks, WhatsApp notifications, bounce and complaint events
Platform activity data — user actions, audit logs, approvals, comments, task actions, notification records
AI processing data — prompts, retrieved context, generated content, recommendations, summaries, lead research outputs, document generations

Subprocessor & Provider Schedule

a) Core subprocessors

Provider	Purpose	Data Processed
Anthropic (Claude — Sonnet 5)	Primary LLM for AI chat, content generation, lead research, document generation, SEO commentary, and conversation summarisation	Prompts, brand context, lead data, generated content, conversation history
OpenAI (GPT model + GPT Image)	Alternate LLM selectable in AI chat; primary image generation engine for Content Hub and creative production (DALL-E / GPT Image)	Prompts, brand context, image generation requests, generated outputs
Google Gemini	Third image generation provider in Content Hub alongside OpenAI and Higgsfield	Image prompts, brand context, generated image outputs
Tavily (via MCP protocol)	Web search layer integrated into AI chat responses; used when the assistant performs live research	Search queries derived from user prompts; no personal data submitted directly
Higgsfield AI	AI video generation (task AI Video tab and Content Hub playground) and AI image generation (soul and standard models)	Brand name, motion prompts, seed images, generated video and image outputs
Magnific (Freepik)	Creative AI image generation and enhancement (mystic, seedream-4.5, and other models) in Content Hub	Image prompts, brand references, uploaded seed images, generated image outputs
AWS S3	All file and asset storage — brand assets, uploads, task attachments, generated documents, contracts, invoices, media files	All file types uploaded to the platform; presigned URL access
AWS SES (Simple Email Service)	All transactional email delivery — onboarding emails, portal notifications, approval links, report alerts, workflow notifications, email marketing broadcasts and flows	Recipient email addresses, message content, sender identity, campaign metadata
AWS SNS (Simple Notification Service)	Receives SES email event webhooks — bounces, complaints, opens, clicks — for suppression management and engagement tracking	Email addresses tied to bounce/complaint/engagement events
MongoDB Atlas	Primary application database — stores all leads, clients, users, roles, tasks, campaigns, approvals, reports, settings, and audit data	All structured application data
Redis	BullMQ job queue backing all background jobs (email sends, video generation, ad syncs, SEO ingestion, social listening, report generation) and caching layer	Job payloads — may include tenant IDs, lead IDs, asset references
Puppeteer / Chromium	Server-side HTML-to-PDF generation for lead research reports and AI-generated report documents	Report content, brand data, generated document HTML
Twilio	Outbound WhatsApp notifications for approval alerts, onboarding reminders, and task or request notifications	Recipient phone numbers, message content
Microsoft Azure AD / Entra ID	Single sign-on (SSO) authentication for internal platform users	User identity, email address, authentication tokens
Microsoft Graph API	Microsoft Teams integration (approval and workflow notifications); Outlook email analytics; user profile photos	Teams channel IDs, notification content, email metadata, profile photo data

b) Client-authorized platforms

Provider	Purpose	Data Processed
Meta (Facebook / Instagram)	Ad account connection, campaign management, ad performance sync, creative data, Meta Ads lead forms, messaging inbox, webhook event ingestion	Ad account data, campaign metrics, spend, creative files, lead form submissions, inbox messages
Google Ads	Ad account connection, campaign management, keyword and performance data sync	Ad account data, campaign names, spend, impressions, clicks, conversion data
LinkedIn Ads	Ad account connection, campaign management, B2B audience and performance data	Campaign names, spend, impressions, clicks, lead form data, audience metadata
Google Search Console	SEO site health ingestion, on-page analysis, keyword performance, click and impression data for SEO reports	Search queries, URLs, clicks, impressions, average position, crawl data
Google Analytics 4	Website traffic and engagement data used in SEO reports and channel reporting	Sessions, users, page views, device breakdown, country breakdown, engagement metrics
Google Drive / Docs	Onboarding document management — creating and storing structured client documents during the onboarding workflow	Document content, client name, brand information
Microsoft Clarity	Per-client website behaviour analytics — scroll depth, rage clicks, dead clicks, session recordings, heatmaps	Session behaviour data, IP addresses (Clarity-processed), interaction events

c) Social listening sources

Source	Purpose	Data Processed
GDELT	Global news and media monitoring for brand and keyword mentions	Publicly available news article metadata and content snippets
Hacker News (Algolia API)	Tech community discussion monitoring for brand and keyword mentions	Publicly available post titles, URLs, and discussion content
Bluesky (AT Protocol)	Social post monitoring for brand and keyword mentions	Publicly available posts matching monitored keywords
Stack Exchange API	Q&A community monitoring for brand and keyword mentions	Publicly available questions and answers matching monitored keywords

Platform Module to Provider Mapping

Platform Area	Active Providers
AI Chat	Anthropic, OpenAI (alternate), Tavily (web search), AWS S3 (document attachments), Puppeteer (PDF generation)
Leads & Lead Scoring	MongoDB Atlas, Anthropic (enrichment + research), Tavily (web research), AWS SES (notifications), Puppeteer (research PDFs), AWS S3
Content Hub	OpenAI (image generation), Higgsfield AI (image + video), Magnific/Freepik (image generation), AWS S3, Redis (job queue)
Email Marketing	AWS SES, AWS SNS (event webhooks), MongoDB Atlas
Client Portal	MongoDB Atlas, AWS S3, AWS SES, Twilio (WhatsApp), Microsoft Azure AD (auth)
SEO	Google Search Console, Google Analytics 4, Anthropic (AI commentary), MongoDB Atlas, Redis
Social Listening	GDELT, Hacker News, Bluesky, Stack Exchange, MongoDB Atlas, Redis
Channels (Ads)	Meta, Google Ads, LinkedIn Ads, Redis (sync jobs)
Reports	Anthropic (commentary), Puppeteer (PDF), AWS S3, MongoDB Atlas
Onboarding	AWS SES, Twilio, Google Drive/Docs, AWS S3, MongoDB Atlas
Authentication	Microsoft Azure AD / Entra ID (SSO), platform JWT (internal)

Data Retention

Nathan & Brank and its relevant providers retain personal data only for as long as necessary to provide the services, meet contractual obligations, comply with legal requirements, resolve disputes, maintain security, support audits, or operate backup and disaster recovery processes.

Changes to this Schedule

Nathan & Brank may update this Schedule from time to time to reflect changes in providers, services, platform functionality, security requirements, legal obligations or operational needs.

Contact

Questions about this Schedule, subprocessors, platform providers, data protection terms or international transfers may be sent to support@nathanbrank.com.