Current subprocessors
| Provider | Service | Data they may process | Region |
|---|---|---|---|
| Cloudflare, Inc. | Application backend (Workers + KV), CDN hosting, DDoS protection | Family member name, email, push token; resident profile metadata; family messages; pending-call signalling; server access logs | UK / EU edge where available; otherwise global edge |
| Google LLC (Firebase) | Cloud Messaging (push notifications to Android), anonymous usage analytics | FCM push token; aggregate analytics events (no personal data) | EU and US data centres |
| Apple Inc. | Apple Push Notification service (push to iOS, iPadOS) | APNs push token | Apple's global network |
| Agora.io, Inc. | Real-time video and audio calling between family and resident | Channel identifier; live audio/video stream in transit (not stored by Agora or Nemora) | Global edge |
| Google LLC (Generative Language API · Gemini) | Optional Willow AI conversational companion — generates responses to what the resident says or types | The text the resident speaks or types to Willow AI, plus the system context provided at request time (resident's first name, life-story chapters, recent family messages, mood log entries). Sent at the moment of each request only; not retained by Google for model training under the API terms in force. | EU and US data centres |
Crash reporting: Willow uses an on-device crash logger only. Crash reports are written to a local file inside the app and are never transmitted off-device unless the user explicitly chooses to share the log via the device's native share sheet (for example, to email it to us during a support case). No third-party crash-reporting subprocessor is used.
Public-archive content sources
Willow surfaces music, video and photography from public archives. These are not subprocessors — they don't see any user data — but we list them here for completeness because content from these sources is loaded directly into the resident's device when used:
- Internet Archive — public-domain audio and video
- BBC Archive feeds (where available)
- Europeana — European cultural heritage media
- Smithsonian Institution — image and audio collections
- BFI Player — British film heritage
- YouTube Data API — for the Classic British TV provider
How we choose subprocessors
Before adding a subprocessor we evaluate:
- The minimum data they need to provide their service
- Their security posture (certifications, public security documentation)
- The lawful basis for any international transfer (UK IDTA / SCCs / adequacy)
- Whether they offer a Data Processing Agreement we can countersign
Every subprocessor signs (or accepts by reference) data-protection terms equivalent to those in our Data Processing Agreement.
Notice of changes
We will give care-home customers at least 30 days' notice before adding a new subprocessor or changing how an existing one is used in a material way. This page is the canonical record — its "Last updated" date at the top reflects the date of the most recent change.
If you would like to subscribe to email notifications of subprocessor changes, email [email protected] with the subject "Subprocessor notifications".
Objections
If you are a care-home customer and you object to a new subprocessor on reasonable data-protection grounds, contact [email protected] within the 30-day notice window. We will work with you in good faith to resolve the concern, which may include offering an alternative provider or, if no resolution is possible, providing a pro-rata refund of unused subscription fees.
Contact
Questions about subprocessors:
[email protected]