Graded Prompts — Subprocessors

Last updated: 19 August 2026

This page lists the third-party service providers ("subprocessors") that Graded Prompts Ltd uses to operate the Graded Prompts platform at gradedprompts.com, and separately lists the independent controllers we share data with. It supplements our Privacy Policy and is maintained as a separate page so it can be kept up to date independently. A subprocessor is a third party that processes personal data on our behalf to help us deliver the Platform. We share only the data each subprocessor needs to perform its specific function, and each is bound by contractual data-protection terms. Some parties we work with are independent controllers rather than subprocessors — they receive personal data but determine their own purposes and means of processing under their own legal obligations. They are listed separately in Section 2.

1. Current Subprocessors

These parties process personal data on our behalf, under our instructions, pursuant to a Data Processing Agreement.

Infrastructure

Security and Anti-Abuse

Communications

Analytics

AI Model Infrastructure (Platform Runs)

These providers execute prompt runs for the Platform Run feature: when a buyer runs a purchased prompt on the Platform, our servers send the prompt text — with the buyer's variable values filled in — to the provider's API and store the generated output. Requests are made server-side from our own infrastructure under our own accounts: these providers do not receive the buyer's name, email address, account identity, or IP address. The only personal data that can reach them is whatever a buyer chooses to type into a prompt's variables.

Note on transfer instruments: For transfers to the USA, our primary mechanism is the UK–US data bridge (the UK Extension to the EU–US Data Privacy Framework) where the US recipient holds an active certification under it — which each US subprocessor above currently does, except the AI model infrastructure providers. Where the data bridge is not available, the ICO recognises two Article 46 instruments for restricted transfers: the standalone International Data Transfer Agreement (IDTA) and the UK Addendum to the EU SCCs. We confirm each provider's certification status against the public DPF list and the applicable instrument against its published DPA, and we update this page if either changes.

2. Independent Controllers

The following parties receive personal data but act as independent data controllers for that data, because they have their own legal obligations (under PSD2, anti-money-laundering rules, card-network rules, and similar). They are not our subprocessors. Their own privacy policies govern how they handle your data, and we encourage you to review them.

Payments and Payouts

Banking and Network Operators

• Wise Payments Limited (Wise Business) — our operating bank. Wise receives aggregate settlements paid to Graded Prompts Ltd and does not process personal data of individual buyers or sellers on our behalf. Wise acts as an independent data controller for any data we provide to it.
• Card networks (Visa, Mastercard, etc.) — payment-network operators that route transactions; they are independent controllers.

Because these parties are independent controllers, the international transfers of personal data they make are governed by their own transfer arrangements and privacy policies, not by our processor safeguards. Where we provide them with data, that disclosure is a controller-to-controller sharing covered by Section 4 of our Privacy Policy.

3. Other Parties (Not Processors of User Data)

For clarity, the following are involved in operating Graded Prompts but do not process buyer or seller personal data:

• Our UK formation agent and Companies House — these relate to corporate registration, not user data processing.

4. Analytics, Advertising, and Tracking

For site analytics we use PostHog (listed in Section 1) in a strictly cookieless configuration: it stores nothing on your device, does not track you across sites, and counts visitors using a short-lived, irreversible hash — so no consent banner is required under UK PECR. We do not use advertising or cross-site tracking providers. If we ever add a provider that stores information on your device or tracks you across sites, we will update this page and the Privacy Policy before it goes live and request consent where required.

5. Updates to This List

We may add or change subprocessors as the Platform evolves. When we do:

• We will update this page with the new entry and the "Last Updated" date.
• If a future enterprise or team customer has a Data Processing Agreement with us that requires advance notice, we will follow the notice period agreed in that DPA.

6. Where Your Data Is Hosted

Primary Platform data is hosted with AWS in us-east-1 (Virginia, USA). Some of our subprocessors and independent controllers are also located outside the UK and EEA. Where personal data is transferred to the USA, we rely on the UK–US data bridge (the UK Extension to the EU–US Data Privacy Framework) for recipients that hold an active certification under it. For any transfer to a country without a UK adequacy decision, or to a recipient not covered by the data bridge, we rely on the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment and supplementary measures where appropriate. These Article 46 safeguards are also kept in place as a fallback should a recipient's DPF certification lapse.

7. Contact

Questions about our subprocessors, transfer safeguards, or to request copies of the relevant data protection terms:

Email: privacy@gradedprompts.com Company details and registered office: gradedprompts.com/legal/company-information

This page was last reviewed and updated on 19 August 2026.