Skip to content

Sub-processors

Last updated: 2026-10-21. We read the agreements below on 2026-10-04, read them again on 2026-10-07 for the ANPD's clauses, read Stripe's on 2026-10-07, and read AWS's on 2026-10-21.

A sub-processor is a company that handles your contacts' data for us. The data processing agreement lets us use the ones on this page. Before we add or replace one that handles your data, we email your workspace's owners 30 days ahead.

Each one is named with what it does, what it receives, where it works and what its own agreement says about moving data between countries. When an agreement names no mechanism, we say so and name none. The privacy policy has the same facts in section 8.

Our data processing agreement lets us send your contacts' data on to the companies under the first heading, and only those (section 9). None of them has signed the ANPD's clauses with us.

Companies that can handle your contacts' data

netcup GmbH, Karlsruhe, Germany

  • What it does for us: rents us the servers. One runs the service and holds its database. The other is our address-checking server.
  • What it receives: everything those servers hold. That is the database, with your contacts, messages and sealed mailbox logins. On the checking server, the address being checked and the names of its domain's mail servers, with no copy kept.
  • Where it works: the United States.
  • Its agreement: netcup's data processing agreement, made in its customer panel. It names no transfer mechanism. It says the customer decides where the data is processed.

Cloudflare, Inc., United States

  • What it does for us: answers DNS for our domains, hosts the console and this site as static pages, and stores the nightly backup copies.
  • What it receives: the backup copies, which we encrypt with a key kept offline before they leave our server, so it cannot read them. For the console and this site, the IP address and request details of whoever loads a page. Traffic to our API goes straight to our server, so no contact data passes through Cloudflare. Once we switch on the sign-in security check (Turnstile), Cloudflare will also receive the IP address of whoever loads it.
  • Where it works: on Cloudflare's own network. We have not pinned the backup bucket to a region.
  • Its agreement: Cloudflare's customer data processing addendum, version 6.4 of 3 April 2026. For transfers from the EEA that need it, it applies the EU's standard contractual clauses (Module Two, or Module Three when the customer is a processor), with the UK addendum and a Swiss version. It also says Cloudflare complies with the EU-U.S. Data Privacy Framework and holds Global CBPR and Global PRP certifications. It does not mention the ANPD's clauses or the LGPD. Its own sub-processors are listed by Cloudflare.

MillionVerifier, Hungary

  • Company: GBD Software as a Service Private Limited Company, Lakitelek, Hungary.
  • What it does for us: tells us whether an email address can receive mail, for the addresses our own checking server cannot answer.
  • What it receives: the address, nothing else. It keeps it in its cache up to 7 days, and in its backups until they are replaced.
  • Where it works: the company is in Hungary. It runs its checks on servers and proxies in several countries, the United States among them. Its own list is here.
  • Its agreement: MillionVerifier's data processing agreement, published 26 August 2026. It names no transfer mechanism. It says only that where a transfer is subject to Chapter V of the GDPR, MillionVerifier will use a lawful transfer mechanism required for it, and that it signs no country-specific transfer agreement unless the law also requires one for its own processing. It does not mention the ANPD's clauses or the LGPD.

Companies that do not receive your contacts' data

Amazon Web Services, Inc. (Amazon SES), United States

  • What it does for us: its email service, Amazon SES, delivers mail about your account: sign-in links, password resets, alerts, notices and the codes that confirm a mailbox's address. Campaign mail never goes through it, and an alert email never carries a prospect's address or words.
  • What it receives: your address, your name and the message itself. AWS's service terms let AWS, or companies it uses, store and scan each message to block spam, phishing and viruses. If our email to you bounces for good, or you mark it as spam, Amazon SES keeps your address on our account's list of addresses it sends nothing to, until we take it off.
  • Where it works: in AWS's US East (N. Virginia) region, us-east-1, in the United States. Its agreement says that once the customer picks a region, AWS does not move the data out of it, except to provide the service or to obey the law or a binding order from an authority.
  • Its agreement: AWS's data processing addendum, part of the AWS service terms, which were last updated on 13 October 2026. It applies the EU's standard contractual clauses only to data the GDPR covers that goes to a country outside the EEA with no adequacy decision from the European Commission: the clauses between a controller and a processor, or between two processors when the customer is a processor. They do not apply if AWS has adopted binding corporate rules or another recognised standard for those transfers. The service terms add a UK addendum and a Swiss addendum. None of these texts mentions the ANPD's clauses or the LGPD. AWS's page on Brazil's law says it offers "a Data Processing Agreement that meets the requirements of LGPD", but it names no mechanism for data that leaves Brazil. So we name none.

Stripe

  • What it does for us: takes payment for the paid plans.
  • What it receives: from us, only the workspace's id. On its own payment page you give it your email, your card and your billing details, which never reach us. It never receives your contacts' data.
  • Where it works: its agreement sends the data to Stripe, LLC in the United States, and to Stripe's affiliates and sub-processors in other countries.
  • Its agreement: Stripe's data processing agreement, last updated 28 September 2026, which is part of Stripe's services agreement, and its data transfers addendum, last updated 18 November 2025. The addendum names the Data Privacy Framework, the EU's standard contractual clauses, the UK's international data transfer addendum and a Swiss version of them. Its section 11 applies the ANPD's standard contractual clauses to data that goes from Brazil to a country with no adequacy decision from the ANPD: the exporter is the party to the agreement with Stripe, and the importer is Stripe, LLC. For part of its work Stripe decides the purposes on its own, and there it is a controller, not our processor.

Not sub-processors

  • Your mail providers (Google, Microsoft, Zoho Mail, or the SMTP host you chose). Every message is sent and received through them, under their terms. They are your providers, not ours.
  • Supabase's sign-in service and database, which we run ourselves on our own server. Nothing leaves our server for them.