Sub-processors

Last updated: 17 October 2026

Our Man in the Fifth Ltd uses these suppliers to run Marker. Each one holds or processes data in the United States, under the transfer safeguard shown. No EU storage option is offered.

Suppliers that process trainers' client data

Netlify, Inc.
Purpose: Hosting the website and app, including Marker's own web fonts; serverless, edge and scheduled functions; storage of accounts, settings, reports, transcripts, saved dogs and video lists (Netlify Blobs).
Data involved: All Marker data, including all client data and trainer account data. Function logs (kept up to 7 days, by plan) include some trainer email addresses.
Location: United States. Marker's data is held in the default Netlify Blobs region, us-east-2 (Ohio).
UK transfer safeguard: UK Extension to the EU-US Data Privacy Framework; the IDTA applies if that does not cover a transfer (DPA s14.2 and s14.4).
Terms: DPA (updated 9 June 2026); sub-processors

Anthropic, PBC (Claude API)
Purpose: Drafting the client report. Summarising the trainer's public YouTube video titles and descriptions.
Data involved: Transcript, trainer's note, dog and owner details, trainer and business details, the trainer's video and service lists. For summaries: public video titles and descriptions only.
Location: United States.
UK transfer safeguard: UK Addendum to the EU Standard Contractual Clauses (DPA Schedule 3, Section B).
Terms: Commercial Terms; DPA; sub-processors

OpenAI (API, speech-to-text)
Purpose: Typing out the trainer's voice notes.
Data involved: Audio of the trainer's voice note and the text returned. The note may mention the client and the dog.
Location: United States.
UK transfer safeguard: UK Addendum to the EU Standard Contractual Clauses (DPA s4.2).
Terms: DPA (effective 1 January 2026); sub-processors

Suppliers that process trainers' own data or website visitor data

Our Man in the Fifth Ltd is the controller of this data. These suppliers receive no client data.

Stripe
Purpose: Stripe Checkout, subscriptions, invoices, the billing portal and webhooks. Stripe Payments UK, Ltd for UK payment services; Stripe, LLC in the US.
Data involved: Trainer's email, name, billing address, card details (entered on Stripe's page, never seen by Marker), subscription and invoice records, device and fraud data. No client data.
Location: United States and other Stripe locations.
UK transfer safeguard: EU-US Data Privacy Framework including the UK Extension (via Stripe, LLC); otherwise the UK International Data Transfer Addendum.
Terms: DPA; Data Transfers Addendum; sub-processors

Resend
Purpose: Sending free trial, password reset, invitation and plan change emails, and the founders' new-trainer notice.
Data involved: Trainer's email address and the email content (links, plan and price). No client data.
Location: United States.
UK transfer safeguard: UK Extension to the EU-US Data Privacy Framework, with the UK Addendum to the EU SCCs.
Terms: DPA; sub-processors

Google LLC (YouTube Data API v3)
Purpose: Finding the trainer's public videos from their channel address or playlist links, and refreshing the stored video library every 30 days.
Data involved: Only the trainer's public channel address or playlist links, the video identifiers being refreshed, and Marker's API key. No client data and no trainer account data.
Location: United States.
UK transfer safeguard: Not needed: no personal data is sent. Google's own terms and privacy policy apply.
Terms: YouTube API Services Terms; Developer Policies

Google LLC (Google Analytics 4)
Purpose: Counting visits to the Marker website and which pages are used. Not used in the Marker app.
Data involved: Website visitors only, and only after they click Accept on the cookie banner: cookie identifiers, pages viewed, how they arrived, device and browser details, and approximate location. IP anonymisation is on. No client data.
Location: United States.
UK transfer safeguard: UK Extension to the EU-US Data Privacy Framework (Google LLC is certified), with the transfer terms in Google's Ads Data Processing Terms.
Terms: Ads Data Processing Terms; Google Privacy Policy

Training on data and how long each keeps it

Netlify: hosting only. Keeps data until Marker deletes it. Function logs up to 7 days.
Anthropic: does not train its models on our data. Deletes API inputs and outputs within 30 days, or up to 2 years if flagged under its Usage Policy.
OpenAI: does not train its models on our data. Keeps it for up to 30 days to provide the service and identify abuse.
Stripe: payments only. Keeps data as needed to provide the service and as the law requires.
Resend: email only. Keeps sending records for 30 days.
Google (YouTube): no personal data is sent. Marker refreshes its own stored video data every 30 days and drops removed or private videos.
Google (Analytics): kept for the period set in Marker's Google Analytics account (2 months by default).

Other services a browser contacts

These are not Marker sub-processors for client data, but they receive some data from people using Marker.

Browser dictation. Marker types out voice notes with OpenAI. If a browser cannot record audio, Marker falls back to the browser's own speech recognition. In Chrome this sends the audio to Google; in Safari, to Apple.
Stripe Checkout and billing portal. These pages are run by Stripe, under Stripe's own privacy policy and cookies.

Web fonts are served from Marker's own site, so no font service receives visitors' IP addresses.

Changes to this list

We keep this list here, with the date of each change. We do not email trainers about changes. A trainer who objects to a change may cancel at any time, and keeps access to the end of the month they have paid for.

17 October 2026: list drawn up, including Google (Analytics) for website visitors only.

Also see: Privacy policy · Customer terms · Data processing agreement.