Common Mechanics

Data Processing Agreement

Where we handle personal data on a client's behalf we do it as their processor, under the agreement published here. This page holds the agreement itself and the current list of sub-processors.

Check this page periodically — last updated

The agreement

Every version of our Data Processing Agreement is published and archived here. Superseded versions stay online so you can always read the terms that applied to a past engagement.

Sub-processors

These are the third parties that may process personal data belonging to our clients, or to their customers and users, in the course of our work. For each one we record the contracting legal entity, what it does for us, and the countries it processes or stores the data in. The list is versioned: each version is published in full and is never edited afterwards.

We also hold the registered office and a contact point for every sub-processor. Email taylor@commonmechanics.io and we will send them to you.

Version 1.1 · effective

Previous versions

Version 1.0 · effective

  • Vercel – Web hosting

    Entity
    Vercel, Inc.
    Processed in
    United States, Vercel global edge network

  • Cloudflare – Web hosting

    Entity
    Cloudflare, Inc.
    Processed in
    United States, Cloudflare global edge network

  • Hetzner – Servers and infrastructure for client projects

    Entity
    Hetzner Online GmbH
    Processed in
    Germany, Finland

  • GitHub – Source code repositories, issue tracking and build automation

    Entity
    GitHub B.V.
    Processed in
    United States, European Union

  • Blacksmith – Continuous integration runners for client project builds

    Entity
    Blacksmith Software, Inc.
    Processed in
    United States, European Union

  • Resend – Transactional email delivery for client applications

    Entity
    Plus Five Five, Inc. (trading as Resend)
    Processed in
    United States

  • Google – File storage, documents, calendars and email

    Entity
    Google Ireland Limited
    Processed in
    European Union, United States

  • Notion – Internal documentation and project management

    Entity
    Notion Labs, Inc.
    Processed in
    United States

  • Linear – Issue tracking and project management

    Entity
    Linear Orbit, Inc.
    Processed in
    United States

  • Slack – Internal and client communications

    Entity
    Slack Technologies Limited
    Processed in
    United States, European Union

  • Figma – Interface design, prototyping and design review

    Entity
    Figma, Inc.
    Processed in
    United States

  • Adobe – Image, video and document production

    Entity
    Adobe Systems Software Ireland Limited
    Processed in
    European Union, United States

  • 1Password – Credential storage and sharing

    Entity
    AgileBits Inc.
    Processed in
    Canada, United States

  • Anthropic – AI inference for development and content work

    Entity
    Anthropic Ireland, Limited
    Processed in
    United States, European Union

  • OpenAI – AI inference for development and content work — the contracting entity for customers outside the EEA and Switzerland, including the UK

    Entity
    OpenAI OpCo, LLC
    Processed in
    United States, European Union

  • OpenAI – AI inference for development and content work — the contracting entity for customers in the EEA and Switzerland

    Entity
    OpenAI Ireland Limited
    Processed in
    United States, European Union

Data protection lead

Our data protection lead is Taylor Jones (taylor@commonmechanics.io).

How we handle personal data as a controller — visitors to this site, and people who email us — is a separate matter, covered by our privacy notice.