Who else touches the data, and where
A subprocessor is any third party that handles data on our behalf. Naming them is not a formality: if you are a data controller, you need this list to do your own assessment, and a vendor who will not give you one is telling you something.
Two lists, because they are genuinely different. This website and the Ligara application are separate systems with separate processors. Do not read one as covering the other.
Processors for ligara.org
The only personal data this site handles is what you type into the contact form, plus the request metadata any web server necessarily sees.
| Processor | What it does for us | Data it handles | Processing location |
|---|---|---|---|
| Cloudflare, Inc. | Serves this website, provides DNS, and runs the small program that receives the contact form. It terminates TLS, so it processes request contents in the clear as part of delivering them. | IP address, browser and operating system, page requested, approximate location from IP. Contact-form contents in transit. | Global edge network, nearest point of presence. US-incorporated. |
| Cloudflare Web Analytics same processor, separate purpose | Counts page views on this marketing website so we can see which pages are read and where visitors arrive from. Listed separately from Cloudflare's delivery role because it is a different purpose, and a reader checking our disclosure should not have to infer it. It writes nothing to your device: no cookie and no browser storage. | Page visited, referring URL, approximate location from IP, device type, browser and screen size. No cookie, no persistent identifier, and nothing that links one visit to another. | Global edge network. US-incorporated. TODO(legal): record the Chapter V safeguard relied on for Cloudflare, which covers this and the delivery role above. |
| Resend TODO(legal): confirm legal entity | Delivers the contact-form email to our mailbox. It does not store the enquiry beyond its delivery logs. | Everything you put in the form: name, work email, organisation, role, organisation type, team size, instrument models, and your free-text message. |
United States — our sending domain is
provisioned in us-east-1 (North Virginia).
|
| Amazon Web Services sub-subprocessor | Resend delivers mail through Amazon SES. We do not contract with AWS directly; it is in the chain because Resend uses it, which is visible in the message headers of any email we send you. | The enquiry email in transit. | United States. |
| Microsoft TODO(legal): confirm contracting entity |
Hosts the info@ligara.org mailbox where
enquiries arrive and are answered. This is where your
message actually comes to rest.
|
The enquiry and any subsequent correspondence with you. | United Kingdom — the tenant resolves to the UK South region. |
| GoDaddy TODO(legal): confirm legal entity | Domain registrar for ligara.org, and the reseller through which the Microsoft 365 licences are bought. | Domain registration and billing records. No visitor or enquiry data. | US-incorporated. TODO(legal): confirm registrar data location |
| GitHub, Inc. | Stores this website's source code and triggers a deployment when it changes. | None. The repository contains the website's text and images, no personal data. | United States. |
Your enquiry travels through the United States
We would rather draw this than bury it in a table, because it is the one thing on this page a UK or EU controller has to think about.
When you submit the contact form, the data takes this path:
-
Your browser sends the form over TLS to Cloudflare, at the edge location nearest you.
-
Cloudflare runs a small program that validates the form and hands it to Resend. Nothing is written to a database at this step.
-
Resend, in the United States, formats it as an email and sends it via Amazon SES, also in the United States.
-
Microsoft 365, in the United Kingdom, receives it into our mailbox, where it stays until we delete it.
So the enquiry comes to rest in the UK, but steps three and four involve a transfer out of the UK and back. Under UK GDPR Chapter V that requires a safeguard, and identifying which safeguard applies to each vendor is work we owe you rather than work you should have to do.
TODO(legal): confirm, for Resend and Microsoft, the transfer mechanism in force — UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or reliance on the UK–US Data Bridge where the vendor is certified — and record the date each was put in place.
If routing enquiry data through the US is a problem for your organisation, do not use the form. Email us directly, or ask for a call — a message sent straight to info@ligara.org reaches the UK mailbox without passing through Resend at all.
Processors for the Ligara product
This is the software you sign into, not the website. It is listed separately because it holds an entirely different class of data — your compounds, your results — and because its processor list is shorter, which is the point.
| Processor | What it does | Data it handles | Processing location |
|---|---|---|---|
| Supabase TODO(legal): confirm legal entity | Provides the Postgres database, authentication and file storage the application runs on. This is the one place scientific records are held. | Account details, and the scientific data you put in: compounds, structures, assay runs, curve fits, plate maps, inventory, attachments. | TODO(legal): state the project region. This is the single most important residency fact on the page and must not be guessed. |
- No analytics or telemetry vendor is present in the application.
- No error-reporting vendor. Uncaught errors are recorded in our own database, not sent to a third-party service.
- No AI or LLM provider receives your data, and your data is not used to train any model.
- ADMET prediction runs on your machine, as a local process. Structures submitted for prediction do not leave the device.
- Curve fitting, statistics and chemistry run in your browser, so the data being analysed is not sent to us in order to be analysed.
- Enterprise deployments can run on infrastructure you control, which moves the residency question inside your own estate.
The application also loads several open-source scientific libraries from public content-delivery networks at page load. These receive your IP address as part of serving a file, as any CDN does; they receive no scientific data. TODO(legal): enumerate these in the application's own privacy notice at launch, and consider self-hosting them to remove the question entirely.
How you find out when this list changes
Adding a subprocessor is a change to how your data is handled, so it should not happen quietly. Once a data processing agreement is in force, it will commit us to notifying customers in advance of a new subprocessor and to a window in which you can object.
TODO(legal): set the notice period — thirty days is the common figure — and the consequence of a sustained objection, which is normally the right to terminate without penalty. Both belong in the DPA, not here.
Questions, or a vendor-assessment form that needs completing?
Ask us. See also the
privacy notice,
cookies, and the technical detail on
security.
Last reviewed 17 September 2026.