Subprocessors

JN Horizon Ltd uses the service providers below to run JN Tempo. When they process personal data for us, they do so under written terms that require them to protect it. This list forms part of our Data Processing Agreement. Our Privacy Notice explains how we use personal data.

Before we add or replace a subprocessor that processes customer data, we update this page and email customer Admins at least 30 days in advance. Admins can object on reasonable data protection grounds, as our Data Processing Agreement explains.

Active subprocessors

Supabase

• What it does: database, user sign-in (authentication) and file storage. It holds all Customer Data, including uploaded files, and sends password reset emails.
• Data: all categories of Customer Data and account data.
• Where: data is stored in London, United Kingdom. Our contract is with Supabase Pte. Ltd. (Singapore), and Supabase staff may access systems from outside the UK, including from Singapore and the United States, to support and maintain the service.
• Transfer safeguard: the UK Addendum to the EU Standard Contractual Clauses, included in Supabase's Data Processing Addendum.

Railway

• What it does: runs the JN Tempo website, app and server.
• Data: data passing through the server while requests are handled, and technical logs, which can include IP addresses and email addresses.
• Where: EU West region (the Netherlands). Railway is a US company, and its staff may access systems from outside the UK.
• Transfer safeguard: the Netherlands is covered by UK adequacy regulations. For access from the United States, Railway's Data Processing Addendum relies on the UK Extension to the EU-US Data Privacy Framework where the recipient is certified, and otherwise on the UK Addendum to the EU Standard Contractual Clauses.

Cloudflare

• What it does: domain name service, secure connections (TLS), protection against attacks, and delivery of the website.
• Data: IP addresses and request details for every visit. Data in requests passes through Cloudflare encrypted between the browser and Cloudflare, and between Cloudflare and our server.
• Where: Cloudflare's global network, usually the location nearest the visitor; Cloudflare is a US company.
• Transfer safeguard: Cloudflare's certification under the UK Extension to the EU-US Data Privacy Framework, with the UK Addendum to the EU Standard Contractual Clauses in Cloudflare's Data Processing Addendum if that certification stops applying.

Resend

• What it does: sends JN Tempo's emails, such as email verification, invitations, approval notifications, reminders and billing notices, and reports whether they were delivered.
• Data: recipient email addresses and names, and the content of the emails, which can include names, organisation names, dates and amounts.
• Where: Resend stores email data in the United States. Resend is a US company.
• Transfer safeguard: the UK Addendum to the EU Standard Contractual Clauses in Resend's Data Processing Addendum, and Resend's certification under the UK Extension to the EU-US Data Privacy Framework.

Stripe

• What it does: subscription payments, invoices and the billing portal for JN Tempo subscriptions.
• Data: the organisation's name and the email address of the Admin who starts the subscription, plus the payment and billing details entered on Stripe's own pages. JN Tempo does not receive card details. Stripe does not receive contractor records.
• Where: Stripe processes data in the UK, the EEA, the US and elsewhere. Stripe also acts as a controller for some of this data, for example for fraud prevention and its legal obligations.
• Transfer safeguard: Stripe's certification under the UK Extension to the EU-US Data Privacy Framework, and otherwise the UK International Data Transfer Addendum, both in Stripe's Data Transfers Addendum, which forms part of its Data Processing Agreement.

Google (Google Workspace)

• What it does: hosts our support mailbox, [email protected].
• Data: the names and email addresses of people who contact support, and whatever they include in their messages and attachments, which can include Customer Data.
• Where: Google is a US company. Google Workspace data, including our support mailbox, can be stored and processed in the United States and other countries where Google or its subprocessors have facilities.
• Transfer safeguard: the safeguards set out in Google's Cloud Data Processing Addendum, which forms part of our Google Workspace agreement.

Vercel

• What it does: hosted JN Tempo until October 2026. It now only redirects the old address, jntimes.jnlabs.net, to the current site. It no longer runs JN Tempo or connects to our database.
• Data: IP addresses and request details of visits to the old address, which can include the address of a link from an older email.
• Where: the United States. Vercel is a US company.
• Transfer safeguard: Vercel's certification under the UK Extension to the EU-US Data Privacy Framework, and the UK Addendum to the EU Standard Contractual Clauses in Vercel's Data Processing Addendum.

Not currently in use

These providers do not currently receive Customer Data. We will give notice under our Data Processing Agreement before that changes.

• Anthropic (AI model provider, United States): would process the questions and records needed to answer them if Tempo Assistant or AI dashboard summaries were switched on. They are switched off.