The third parties that process data on our behalf so Spendvora can do its job. Each one is limited by contract to processing data for us and nothing else.
| Provider | What they do for us | Data involved | Where |
|---|---|---|---|
| OpenAI, L.L.C. | AI extraction of supplier, line item, VAT and total data from uploaded documents | Contents of the documents you upload for scanning | United States |
| Amazon Web Services (S3) | Private archive storage for uploaded documents after scanning | Uploaded invoices, purchase orders and attachments | Ireland (eu-west-1) |
| Stripe Payments Europe | Subscription and one-off payments after the free trial | Billing contact details and payment records. Card details go straight to Stripe and never reach our servers | Ireland, with group companies in the United States |
| Brainwave Designs mail server | Sending notification emails, purchase orders to suppliers and account emails | Recipient name and email address, message contents, purchase order PDFs | United Kingdom |
|
Xero Limited
Only if you enable it |
Pushing draft bills and purchase orders into your own accounting ledger, and importing reference data from it | Supplier, invoice and purchase order data you choose to send | New Zealand and Australia |
| Hosting provider | Running the Spendvora application servers and database | All application data at rest and in transit | United Kingdom |
Correct as at 26 Jul 2026. Our hosting provider is named in full on request while we finalise the published detail, so ask us at procurement@brainwavedesigns.co.uk if you need it for your own records.
Xero only receives data if you connect it in Settings and then choose to send a draft bill or purchase order. Disconnect it and nothing further is sent.
AI extraction normally runs on our platform OpenAI key. If you add your own key in Settings, the calls are made with your key under your own agreement with OpenAI, and that usage falls outside our platform arrangement.
Sub-processors act on our instructions only. They are not allowed to use your data for their own purposes, and they are bound to confidentiality and security obligations at least as strict as the ones we owe you. Where data goes outside the UK we rely on the UK international data transfer agreement or the addendum to the EU standard contractual clauses.
If we add or replace a sub-processor that handles customer data, we will update this page and change the version date at the top. Account owners can email procurement@brainwavedesigns.co.uk to be told about changes in advance.
The wider picture is in the privacy policy, and the split of responsibility between us is in the terms of use.
Brainwave Designs Ltd · Company No. 17063005 · VAT No. 515 6000 32
Registered in England & Wales · 22 Commerce Road, Lynchwood, Peterborough, PE2 6LR
Questions about this document: procurement@brainwavedesigns.co.uk
