Sub-processors
Third-party services Thyme Studio uses to provide the product, and what each one does with your data.
Supabase
Database, authentication, and file storage — every studio's data is hosted here.
Configurable per project; this deployment uses an EU/UK-region project.
Anthropic
Powers Sprout, the in-app AI assistant (Growth suggestions, chat). Receives only business-level/aggregate context — never client names, contact details, or individual transaction records (see the Context-block rules below).
United States. Data transfer is covered by a Data Processing Agreement and UK International Data Transfer Agreement (IDTA) once executed — see the note below.
Stripe
Billing and subscription payments. Card details never reach our servers — Stripe's hosted Checkout and Billing Portal handle all payment data directly.
Configurable per Stripe account settings.
Sentry
Error tracking, so we can diagnose and fix bugs. Configured to avoid capturing personal data in error reports.
Configurable per Sentry organization settings.
Twilio
Sends SMS messages — booking confirmations, marketing campaigns you send to your clients, and phone-number verification. Processes client phone numbers and message content.
United States (headquarters); sends from a UK number.
Resend
Sends emails — booking confirmations, marketing campaigns, consent-form links, and account emails. Processes client/staff email addresses and message content.
United States.
PostHog
Product analytics — anonymous, aggregate usage data only (which pages/features are used), so we can improve the product. No client personal data; no identified user profiles; no advertising or cross-site tracking. See our Cookie Policy for how to turn this off.
Configurable per PostHog project (EU or US hosting, or self-hosted).
This list is drafted for internal/legal review and is not yet confirmed by counsel. A signed Data Processing Agreement and UK International Data Transfer Agreement with Anthropic are tracked as pre-launch requirements (see the GDPR checklist) and are a manual step for the account owner, not something automated by this page.