Last updated: 3 May 2026
Journey relies on the following third parties to deliver the service. Each one is bound by a written data-processing agreement consistent with UK GDPR Article 28. We will give at least 30 days' notice in-app before adding or replacing a sub-processor that materially affects the processing of your personal data.
| Sub-processor | Purpose | Data shared | Location / safeguard |
|---|---|---|---|
| Clerk, Inc. | User authentication, sign-in, session management | Email, name, sign-in events, session tokens | United States (Standard Contractual Clauses) |
| Replit, Inc. | Application hosting, managed PostgreSQL database, object storage | All tenant data at rest and in transit | United States (Standard Contractual Clauses) |
| Stripe Payments Europe Ltd. | Subscription billing and payment processing | Billing contact, plan, payment metadata (no card numbers stored by us) | Ireland / EEA |
| Resend, Inc. | Transactional email (invitations, notifications, welcome) | Recipient email address, message body, delivery events | United States (Standard Contractual Clauses) |
| OpenAI, L.L.C. | AI assistance for OTJ quality, review drafting, gateway readiness narrative | Pseudonymised prompt content. We do not send direct identifiers. Outputs not used for model training (zero-retention API). | United States (Standard Contractual Clauses) |
See also: Privacy policy · Terms of service