Legal
Sub-Processor List.
Every third party that handles personal data when your organisation uses N Six Hub — who they are, what they receive, and when.
What this page is
N Six Studios Ltd uses a small number of companies to help run N Six Hub — “sub-processors” in UK GDPR terms, because they process personal data on our behalf while we process it on your organisation’s behalf. This page lists every one: what it does, what data it receives, where it processes it, and whether it’s always in use or only runs when you switch a feature on. It forms part of our Data Processing Agreement (DPA) at nsixhub.com/legal/dpa.
One thing worth saying first: this marketing website sends nothing to any third party — no analytics, no trackers, no external requests at all. Everything below concerns the platform.
Sub-processors we always use
These are part of how the platform works for every organisation — they can’t be switched off individually.
| Provider | What we use it for | What it receives | Where it processes |
|---|---|---|---|
| OpenAI, L.L.C. | Powers most AI features — assistant replies, record summaries, call analysis and drafting. | The content you put through an AI feature: prompts and record data, which can include names, contact details and the text transcripts of recorded calls. | United States |
| Google LLC (Gemini) | Backup AI provider, and the provider for image analysis — for example reading a photographed business card. | Prompts when it acts as backup, and photos you submit for analysis, which can contain names, numbers and addresses. | United States (Google’s global infrastructure) |
| ElevenLabs Inc. | Turns the assistant’s written replies into natural speech. | Only the text of the reply being spoken — never a recording of your voice. If it’s unavailable, your browser’s built-in voice is used instead. | United States |
| Hostinger International Ltd | Delivers all outbound email — invites, password resets, invoices, and the campaigns you send. | Recipient email addresses and the full content of each message, including attachments. | European Union (Lithuania) |
| TomTom International B.V. | Turns addresses into map coordinates, plans routes and supplies traffic data. | The addresses you look up, and record addresses geocoded to place them on the map — often customers’ home or site addresses — plus the coordinates used for routing. | European Union (Netherlands) |
| OpenStreetMap Foundation (Nominatim) | Address search when TomTom can’t answer — turning the addresses you search into map coordinates. | The text of searched addresses — what you type into address search — often customers’ home or site addresses. | United Kingdom and European Union (OpenStreetMap Foundation servers) |
| Stripe | Billing for your N Six Hub subscription itself — nothing else. | Your billing contact’s name, email and address, and invoice details. Card numbers are entered on Stripe’s own payment forms; we store only the card brand, last four digits and expiry. | European Union and United States |
| OVH (OVHcloud) | Provides the servers the entire platform runs on. | Everything the platform stores lives on OVH-provided infrastructure. OVH runs the machines; it plays no active part in your data. | United Kingdom |
Engaged only when you enable a feature
These receive nothing unless your organisation turns the relevant feature on.
| Provider | What it does, and when | What it receives | Where it processes |
|---|---|---|---|
| Twilio Inc. | SMS sending and phone calls — engaged only when your organisation switches those features on. | Recipient phone numbers and SMS message content; call audio and phone numbers pass through Twilio while calls are made. If you connect your own Twilio account instead, your contract is with Twilio directly. | United States |
Connections made from your browser, and map data
When you’re signed in to the platform, your browser loads fonts from Google and — on map screens — the Google Maps service. That means your IP address, the map area you view and any addresses you search there reach Google. Map imagery also comes from OpenStreetMap and OpenFreeMap tile servers, which see your IP address and the area you’re viewing.
On our side, a few open-data services are used as well. Overpass servers run by FOSSGIS e.V. (Germany) and Kumi Systems e.U. (Austria) receive coordinates for points-of-interest and speed-camera lookups, and Open-Meteo (Germany) receives coordinates for weather. Route planning falls back to the OSRM project’s public demo server when TomTom can’t answer; it receives the start, end and via coordinates of the route. Coordinates can indirectly reveal where a site — or a person — is, which is why they’re disclosed here. Address search is different: there the address text itself can be sent, which is why Nominatim appears in the table above rather than in this paragraph.
Where data leaves the UK
Five providers on this page — OpenAI, Google, ElevenLabs, Stripe and Twilio — process data in the United States. For those transfers the safeguard we rely on is the UK Addendum to the EU Standard Contractual Clauses or the UK International Data Transfer Agreement, and we require it of each provider in its data-processing terms.
Providers processing in the EU are covered by the UK’s adequacy regulations for the EEA, so no extra mechanism is needed. If you want the specifics for a particular provider, email privacy@nsixhub.com.
Deliberately not on this list
Several things that look like third-party services aren’t. Video calls and meetings run on media servers we operate ourselves. Call and meeting recordings are transcribed by software running on our own machines — the audio never goes to a cloud transcription service; only the resulting text passes through the AI providers above when you use analysis features. Your files sit on storage infrastructure we run. Listing vendors for any of those would overstate what’s shared, so we don’t.
HMRC isn’t a sub-processor either. When your organisation files VAT through the platform, the return figures — and the fraud-prevention data HMRC requires by law — go to HMRC as an independent public authority, on your instruction.
Services you connect yourself are your own processors, not ours: merchant payment accounts you plug in to take your customers’ payments (Stripe, SumUp, Square, Adyen or Worldpay), dialler apps you configure, email mailboxes you connect, and automation or webhook destinations you point data at (Zapier, Make, or anything else). You choose them, your agreement is with them, and we send data only where you direct it.
Changes to this list
We add or replace a sub-processor only after updating this page and emailing the owner of every subscribed organisation, at least 30 days before the change takes effect. If you object on reasonable data-protection grounds and we can’t resolve the objection, you can terminate the affected service or your subscription, and export your data first. Our Data Processing Agreement (DPA), at nsixhub.com/legal/dpa, makes the same commitment formally.
Questions about anyone on this page: privacy@nsixhub.com. Last updated: 3 September 2026.