What this page is
Studios use Millstone to hold data about their clients, contractors and leads. For that data the studio is the controller and Millstone processes it on the studio's behalf. To do that we use a small number of other companies. They are our sub-processors, and this page names all of them and says what each one gets.
It sits alongside the privacy notice, which explains what is collected and why.
Supabase
What it is. Our database, our sign-in system and our file storage. It is the one place Millstone keeps anything.
The database. Every record Millstone holds: studios and their members, companies, people and contractors, requests to open a studio, feedback, projects, tasks, deliverables, reviews, meeting notes, time entries, expenses, bookings, proposals, contractor agreements, invoices, form responses, the signatures recorded against proposals and agreements, the usage analytics log and the error log.
Authentication. The email address you sign in with, and your password, which is held by Supabase and never seen or stored by us.
File storage. Private buckets for the files uploaded to projects, the images set on records, and screenshots attached to feedback. Every one of those files is served through the application after a permission check. One bucket is public: it holds the typefaces a studio uploads for its own branding, which contain no personal data.
Email. Supabase's authentication service writes the sign-in link, the password-reset link and the first invitation to an account, and hands them to Resend to deliver, so your email address reaches it as mail as well as a database row.
Categories of data reaching it. All of them: contact details, account credentials, project content, uploaded files, signature records including the IP address and browser user-agent captured at signing, and the analytics and error logs.
Where. Paris, France (eu-west-3). Contracting entity and data processing terms we rely on: Supabase Pte. Ltd. (Singapore), under Supabase's data processing addendum, which carries the EU Standard Contractual Clauses with the UK Addendum.
Vercel
What it is. Our hosting. Millstone is deployed to Vercel and every request to it passes through Vercel's network before it reaches our code.
What we use it for. Serving the application: its pages, the server actions behind every form, the routes that stream files out of storage, and the public links a studio sends.
Categories of data reaching it. Anything in a request or a response, in transit, so in principle any of the data above at the moment it is viewed, submitted or downloaded. Vercel is not where the data lives; it is what it travels through. It also sees the ordinary properties of a request: the IP address it came from, the browser user-agent, and the address asked for.
Where. Paris, France (cdg1), beside the database. Vercel Inc., under Vercel's data processing addendum; Vercel is certified under the UK Extension to the EU-US Data Privacy Framework.
Resend
What it is. The service that sends the email Millstone writes.
What we use it for. A proposal, invoice or review a studio sends, a signed copy, reminders, an invitation to a studio, notices about a studio's account, trial and payments, the error summary sent to the operator, and the sign-in, reset and invitation mail Supabase writes. A studio's mail goes out under the studio's name from hello@millstone.work, and a reply reaches the studio's own address.
Categories of data reaching it. The recipient's address, the message, and any document attached to it, such as a proposal or invoice as a PDF. It also holds the list of studio staff who opted in to product news, and sends those emails; nothing else is uploaded to it.
Where. Plus Five Five, Inc. (Resend), United States, under Resend's data processing addendum with the UK Addendum to the EU Standard Contractual Clauses. Resend keeps its sending logs for 30 days.
Stripe
What it is. Payment for a studio's subscription to Millstone. This is a studio paying us, not a client paying a studio: invoices a studio raises inside Millstone are records, not payments.
Categories of data reaching it. The studio's billing email address and identity. Card numbers are entered on Stripe's own pages and never reach Millstone. Stripe tells us the state of the subscription.
Where. Stripe Payments Europe, Limited (Ireland), under Stripe's data processing agreement; Stripe is certified under the UK Extension to the EU-US Data Privacy Framework.
Cloudflare
What it is. The company Millstone's domain, millstone.work, is registered with, and which answers for its addresses.
What we use it for. Two things. When a browser or an assistant asks where Millstone, its assistant connection or its public API lives, Cloudflare answers; it does not sit in front of Millstone, so pages, forms and files go straight to Vercel and never pass through it. And mail sent to hello@ or support@millstone.work arrives at Cloudflare first, and its Email Routing forwards it to the inbox of the person who runs Millstone.
Categories of data reaching it. For addresses: the name looked up and the network address of whoever asked, which every DNS provider sees. For mail: the whole of each message sent to those two addresses, including the sender's address, the body and any attachments, for as long as it takes to forward it. Cloudflare states that it does not keep the messages it forwards.
Where. Cloudflare, Inc., under the data processing addendum its self-serve terms include; Cloudflare is certified under the UK Extension to the EU-US Data Privacy Framework, with the Standard Contractual Clauses and UK Addendum as a fallback.
What it is. Calendar and video meetings, only when somebody at a studio has connected their own Google account.
What we use it for. Millstone reads that calendar's free and busy times, so the slots it offers are ones the person is free for. That request sends Google a date range and the calendar's identifier, and nothing about you. When you confirm a booking, Millstone creates the meeting in that calendar, which is what produces the video link.
Categories of data reaching it. For a booking: your name, your email address, and the meeting's title and times. The note you wrote about what you would like to discuss stays in Millstone. You are added as a guest, so Google emails you the invitation and, if the meeting is cancelled, the cancellation. Nothing else reaches Google.
If nobody has connected a calendar, the booking is confirmed by Millstone on its own and no data goes to Google.
Where. Google LLC. For calendar access Google acts under its own API terms as a separate controller, not as our processor, and is certified under the UK Extension to the EU-US Data Privacy Framework.
AI assistants, only if somebody connects one
A person can connect Claude or ChatGPT to their Millstone account. While the connection is live, that assistant can read and change what the person could read and change themselves, in their own studio, under the same permissions their login has, and what it reads reaches the company that provides it. It is off unless somebody sets it up, it can be revoked at any time from account settings, and every call it makes is recorded. If nobody in a studio connects an assistant, no data from that studio reaches a model provider.
The assistant is a tool the person chooses and connects under their own agreement with its provider, such as Anthropic or OpenAI. Millstone does not send data to it on its own initiative, so it is not one of our sub-processors.
That is the whole list
Seven companies: Supabase, Vercel, Resend, Stripe, Cloudflare, and, only when somebody connects one, Google and an assistant provider. A list invites the assumption that something has been left off, so here is what is deliberately not on it.
No third-party analytics in the application. The usage log described in the privacy notice is written to our own database. No analytics product, tag manager or advertising script runs on any page of the application.
No third-party fonts, scripts or embeds. The typefaces are packaged into the application when it is built and served from its own domain. A page of the application loads nothing from any other origin: the Google, Stripe and Resend calls described above are made by our server, not by your browser.
No other email or error-tracking product. Errors are recorded in our own database.
Millstone's public website runs on Vercel, which serves its pages and keeps ordinary request logs; the site itself runs no analytics, sets no cookie and loads nothing from any other company. The privacy notice describes it.
How this list is kept up to date
By hand. Nothing generates this page and nothing checks it against the code, so it is only as accurate as the last person who edited it.
If a service is added to Millstone that receives personal data, it must be added in three places: this page, the "Who we share it with" section of the privacy notice, and the "That is the whole list" section above. Last reviewed: 24 October 2026.
Changes, and how to contact us
If we take on a new sub-processor we will update this page. Notice we give studios before a change takes effect: 30 days, by email to each studio's owners.
Questions about anything here: email support@millstone.work. Millstone is operated by Farside Ltd, The Conifers, Wardington, Banbury, OX17 1SP.
---
Draft, not legal advice. This list was assembled by reading the application's source code and describes the system as built. It has not been reviewed by a solicitor, and every bracketed item above still needs an answer. It should be checked professionally before it is relied on.