Last updated: 15 September 2026
To run the Inventory Forecaster we rely on a small number of specialist companies — for hosting, sign-in, email, card payments and error monitoring. This page lists every one of them, what each can actually see, and how we tell you when the list changes.
Your data is never sent to an AI or machine-learning service. There is no ChatGPT, Claude or similar anywhere in the product. The forecasting maths runs inside our own database.
When you use the Inventory Forecaster, your business data is stored and processed on our behalf by a handful of specialist providers. Under UK GDPR these are called "sub-processors". We remain responsible to you for what they do with your data.
We keep this list short on purpose. Every additional company with access to your data is additional risk, so we only add one where it genuinely earns its place.
These apply to the Englander Inventory Forecaster.
| Provider | What it does for us | What it can see |
|---|---|---|
| Supabase Supabase Inc. |
Hosts the database. This is where your data actually lives. | All data you hold in the service: products, cost prices, stock levels, sales history, suppliers, purchase orders, and your users' names and email addresses. |
| Vercel Vercel Inc. |
Runs the application itself — the web pages and the background jobs. | Data passing through while a page loads or a job runs. Vercel does not keep a copy of your database. |
| Clerk Clerk.com (Clerk Inc.) |
Handles sign-in, passwords and user sessions. | Your users' names, email addresses and login activity. No product, stock or sales data. |
| Upstash Upstash Inc. (QStash) |
Schedules the overnight jobs — the nightly sync and report runs. | Scheduling information only: which account a job belongs to and what type of job it is. No product, stock or sales data. |
| Resend Resend Inc. |
Sends our outbound email — reorder reports, alerts and invitations. | The recipient's name and email address, and whatever is in the email itself (a reorder report will list products and quantities). |
| Sentry Functional Software, Inc. — EU data region (Germany) |
Error monitoring. When something breaks in the application, a report is sent so we can fix it before you have to tell us. | The error message, which page or job it happened in, the browser type, and the code path. Cookies, passwords, sign-in tokens, request contents and IP addresses are stripped before the report leaves our server. No product, stock or sales data is sent unless it happens to appear in an error message. Reports are stored in Sentry's EU region. |
| Stripe Stripe, Inc. / Stripe Payments Europe Ltd |
Takes subscription payments. | Your billing contact details and your card details, which you enter directly with Stripe. Card numbers never reach our systems. |
| Open-Meteo Open-Meteo (Zurich) |
Supplies weather data, which helps explain seasonal demand. | Nothing. We request public weather figures for a geographic area. No customer data is sent. |
Your Linnworks account is your system, not ours. You connect it, and you can disconnect it at any time. We read your products, stock and sales history from it — and write back purchase orders where you ask us to — acting on your instructions.
Because Linnworks is your own contract with your own provider, it is not a sub-processor of ours. Your relationship with Linnworks is governed by your agreement with them.
We do not send your data to any AI or large language model service. Not for forecasting, not for analysis, not for "product improvement". The forecasting is ordinary statistics — sales history, seasonality and supplier lead times — calculated inside our own database.
If that ever changes, it would be a sub-processor addition and you would be told in advance under section 6 below, with the right to object.
Your data is stored in a database hosted in Frankfurt, Germany (EU).
Some of the providers above are incorporated in the United States. Where personal data is transferred outside the UK or EEA, we rely on the UK International Data Transfer Addendum and the EU Standard Contractual Clauses, together with each provider's own published safeguards.
Before we add a new sub-processor that will handle your data, we will:
Removing a sub-processor, or replacing one with another that does the same job to the same standard, does not require notice — but we will still update this page.
If you need more detail for your own compliance records — a specific provider's certifications, their data processing terms, or a completed security questionnaire — email privacy@englander.ai and we will help.