Our PrioritiesSign in

Stay Nimble Sub-processors

Last updated: 17 September 2026

Current as of 17 September 2026
Stay Nimble Ltd (Company No. 11129024)

This page lists the third-party services Stay Nimble uses to deliver our platform, and what member data each one handles. We publish it so you can see exactly who is involved in supporting you, and so our partner organisations can meet their own data protection obligations. It is referenced from our privacy policy.

A sub-processor is a service that processes personal data on our instructions to help us run Stay Nimble. Each one is bound by a written contract imposing data protection obligations consistent with UK GDPR. We check providers' data protection practices before using them, and we update this page when the list changes. Partner organisations are notified at least thirty days in advance of changes affecting their members' data.

The AI providers listed below process data only on our instructions, and every one is bound by terms that prevent them using member data to train their models.

AI providers behind Nim and our tools

OpenAI

  • Provider: OpenAI, L.L.C.
  • Purpose: powers Nim's conversations, the CV Helper, the Skills Finder, and the planning steps of our job, course, and career search tools.
  • Data processed: conversation content and the profile summary that personalises it, sent with no name or contact details, only an internal reference that means nothing outside Stay Nimble's systems. The exception is the CV Helper, where the CV you upload naturally contains your details. The search-tool steps use anonymised inputs only.
  • Location of processing: United States, with safeguards in place through the EU Standard Contractual Clauses as amended by the UK Addendum (OpenAI Data Processing Addendum, section 4.2).

Anthropic

  • Provider: Anthropic, PBC.
  • Purpose: helps us prepare careers content for the platform.
  • Data processed: careers article content only, not member personal data.
  • Location of processing: United States, with safeguards in place for international transfer under our data processing agreement.

Google (Gemini)

  • Provider: Google LLC.
  • Purpose: helps coaches summarise coaching sessions, under the Google Workspace Data Processing Addendum.
  • Data processed: coaching session content for the session being summarised.
  • Location of processing: European Union.

Platform, hosting, and sign-in

Amazon Web Services

  • Provider: Amazon Web Services, Inc.
  • Purpose: hosts the Stay Nimble platform, our database, uploaded CVs, and the reference knowledge that makes Nim’s answers accurate.
  • Data processed: all platform data, including your profile and CV files.
  • Location of processing: United Kingdom (London region, eu-west-2).

Auth0

  • Provider: Okta, Inc. (Auth0).
  • Purpose: manages sign-in and account security for the platform, Nim, and partner dashboards.
  • Data processed: email address, login credentials (stored hashed), and sign-in history.
  • Location of processing: European Union region.

Vercel

  • Provider: Vercel Inc.
  • Purpose: hosts some of our newer services.
  • Data processed: data in transit and standard server logs.
  • Location of processing: United States, with safeguards through the EU-U.S. Data Privacy Framework.

Supabase

  • Provider: Supabase Inc.
  • Purpose: database and authentication for some of our newer services.
  • Data processed: name, email address, and the records those services hold.
  • Location of processing: configured to use UK/EU regions.

Support and communication

Amazon Web Services (Simple Email Service)

  • Provider: Amazon Web Services, Inc.
  • Purpose: delivers transactional emails, such as your Job Radar results and account emails.
  • Data processed: your email address and the content of the email being sent.
  • Location of processing: United Kingdom (London region, eu-west-2).

Intercom

  • Provider: Intercom, Inc.
  • Purpose: powers in-app messaging between you and your coaching team.
  • Data processed: name, email, your message conversations, and the profile context that helps your coach support you.
  • Location of processing: United States, with safeguards in place for international transfer.

GetResponse

  • Provider: GetResponse Sp. z o.o.
  • Purpose: sends programme emails and, where you have opted in, marketing emails.
  • Data processed: name, email address, and email engagement information (delivery, opens, clicks).
  • Location of processing: European Union.

Calendly

  • Provider: Calendly LLC.
  • Purpose: books coaching sessions.
  • Data processed: name, email, and scheduling information when you book.
  • Location of processing: United States, with safeguards in place for international transfer.

Google Workspace (Google Meet)

  • Provider: Google LLC.
  • Purpose: hosts coaching sessions, governed by the Google Workspace Data Processing Addendum.
  • Data processed: information provided when joining a meeting (typically your name) and standard meeting metadata.
  • Location of processing: configured for UK/EU regions where available; safeguards in place for any international transfer.

Tally

  • Provider: Tally B.V.
  • Purpose: collects application and programme forms.
  • Data processed: whatever the form asks for, typically name, email, and your answers.
  • Location of processing: European Union.

Billing

Stripe

  • Provider: Stripe Payments Europe, Ltd.
  • Purpose: processes card payments. We never see or store your full card details.
  • Data processed: payment card details, name, email, and transaction records, under Stripe's PCI DSS certified systems.
  • Location of processing: European Union / United States, with safeguards in place for international transfer.

Zoho

  • Provider: Zoho Corporation.
  • Purpose: manages subscriptions and billing records.
  • Data processed: name, email, subscription plan, and billing state.
  • Location of processing: European Union data centres.

Running the service

The search tools behind Job Radar, Course Finder, and Career Explorer use the services below. All of them work with anonymised inputs: no name, email, or account identifier ever leaves Stay Nimble through these tools.

Perplexity

  • Provider: Perplexity AI, Inc.
  • Purpose: powers searches for jobs, courses, and career options relevant to you.
  • Data processed: anonymised search inputs, such as a job title, skills, or a location. No member identifiers are sent.
  • Location of processing: United States, with safeguards in place for international transfer under our data processing agreement.

Tavily

  • Provider: Tavily Inc.
  • Purpose: web search behind the job search tools.
  • Data processed: anonymised search queries derived from your job preferences. No member identifiers are sent.
  • Location of processing: United States, with safeguards in place for international transfer under our data processing agreement.

Jina.ai

  • Provider: Jina AI GmbH.
  • Purpose: fetches and validates web pages found by the job and course search tools.
  • Data processed: page URLs only.
  • Location of processing: European Union (Germany).

Bright Data

  • Provider: Bright Data Ltd.
  • Purpose: fallback page fetching for the course search tool.
  • Data processed: page URLs only.
  • Location of processing: outside the UK, with safeguards in place for international transfer under our data processing agreement.

Ably

  • Provider: Ably Real-time Ltd.
  • Purpose: delivers in-app notifications, such as when a tool finishes working for you.
  • Data processed: notification content and an account identifier.
  • Location of processing: European Union.

Datadog

  • Provider: Datadog, Inc.
  • Purpose: monitors platform health so we can find and fix problems quickly.
  • Data processed: technical logs and performance data, which can include account identifiers.
  • Location of processing: European Union.

Sentry

  • Provider: Functional Software, Inc. (Sentry).
  • Purpose: captures technical errors so we can fix bugs.
  • Data processed: error reports, which can include account identifiers and device information.
  • Location of processing: United States, with safeguards in place for international transfer.

Zapier

  • Provider: Zapier, Inc.
  • Purpose: connects internal processes, such as routing programme sign-ups.
  • Data processed: name and email in the automations that need them.
  • Location of processing: United States, with safeguards in place for international transfer.

Credentials

Navigatr

  • Provider: Open Badge Network Ltd (operating as Navigatr).
  • Purpose: issues digital badges for achievements.
  • Data processed: name, email, and badge metadata sent as issuing instructions. Once you create a Navigatr account to claim a badge, your relationship with Navigatr is direct and governed by their terms.
  • Location of processing: United Kingdom.

Analytics

Google Analytics and Google Tag Manager

  • Provider: Google LLC.
  • Purpose: helps us understand how the platform and our websites are used. Google Tag Manager runs in the member app, disclosed by and behind the Cookiebot consent banner; our websites use Google Analytics alone.
  • Data processed: page views, feature usage, and device information, collected only with your cookie consent.
  • Location of processing: United States, with safeguards in place for international transfer.

Cookiebot

  • Provider: Usercentrics A/S (Cookiebot).
  • Purpose: manages the cookie consent banner on the Stay Nimble app and records your choices. Its cookie declaration, listing every cookie, lives inside the banner itself.
  • Data processed: your consent choices and the technical information needed to record them.
  • Location of processing: European Union.

Services that are not sub-processors of member data

We list these for transparency:

  • n8n: the automation engine behind several of our tools runs on Stay Nimble's own infrastructure (self-hosted), so it is not a third party.
  • Prismic: hosts our Resource Library articles. It holds content our team writes, not member data.
  • Companies House: a public register we read from when preparing employer information. No member data is sent to it.
  • Vimeo, YouTube, HeyGen, Arcade: host embedded learning content. They receive standard technical information about your device when you watch, but not your name or account.

Changes to this list

This list is reviewed regularly and updated when sub-processors change. Partner organisations are notified at least thirty days in advance of changes affecting their members’ data. Questions to info@staynimble.co.uk.