Subprocessors
Last updated
How this list works
Each provider below is bound by a written contract with data protection terms. We review a provider's security before adding it.
We update this page and email account owners at least 30 days before adding or replacing a subprocessor that processes customer personal data. Business customers can object as described in our Data Processing Agreement. To receive updates by email, write to [email protected].
Logos of platforms on our website show compatibility; they are not subprocessors unless listed here.
Supabase
Purpose: main database, authentication and file storage for the app.
Data: all workspace data, account data, and Instagram data you connect.
Location: European Union (Frankfurt, Germany).
Transfer safeguard: EU storage; SCCs for any access from outside the EU.
Cloudflare
Purpose: content delivery, DNS, protection against attacks and bots, file storage (R2), and forwarding of emails sent to our @igpone.com addresses (Email Routing).
Data: IP addresses and request data for all visitors; uploaded media and files in R2; emails you send to our addresses.
Location: R2 storage in the EU; network traffic handled at the nearest global edge location.
Transfer safeguard: SCCs and the EU-U.S. Data Privacy Framework.
Hetzner Online
Purpose: server hosting for application services.
Data: data processed by our application services, which may include workspace data.
Location: Germany and Finland (EU).
Transfer safeguard: EU hosting; no transfer outside the EU.
Anthropic
Purpose: AI models that power the agent, drafting and replies.
Data: the prompts and context needed for each request, which may include workspace content, messages and comments. Not used to train models.
Location: United States.
Transfer safeguard: SCCs.
OpenAI
Purpose: AI models that power drafting and replies, and realtime speech processing for voice mode and dictation in our mobile apps.
Data: the prompts and context needed for each request, which may include workspace content, messages and comments, and for voice mode your audio stream (we do not store the audio). Not used to train models.
Location: United States.
Transfer safeguard: SCCs and the EU-U.S. Data Privacy Framework.
Stripe
Purpose: web payments, subscriptions, invoices and tax calculation.
Data: name, email, billing address, tax number, payment details (card data held by Stripe only), subscription and invoice records. Stripe also acts as an independent controller for fraud prevention and its own legal duties.
Location: Global, including the United States and the European Union.
Transfer safeguard: SCCs and the EU-U.S. Data Privacy Framework.
Sentry
Purpose: error monitoring and performance tracking.
Data: technical error data and crash reports from the website, web app and mobile apps, device and browser details, IP address and account ID. We configure it to avoid message content and unnecessary personal data.
Location: European Union (Germany).
Transfer safeguard: EU storage; SCCs for any access from outside the EU.
Better Stack
Purpose: uptime monitoring, logs and incident alerts.
Data: service logs, which may include IP addresses and account IDs but not message content.
Location: United States.
Transfer safeguard: SCCs.
Resend (email delivery)
Purpose: sending sign-in links, trial and renewal reminders, receipts, notifications and weekly reports.
Data: name, email address and the content of service emails.
Location: European Union (Ireland) for sending and storage. Resend is a United States company.
Transfer safeguard: EU sending region; SCCs for any access from outside the EU.
Expo (650 Industries)
Purpose: delivering push notifications from our iOS and Android apps to Apple's and Google's push services.
Data: device push tokens and the text of notifications. Notifications show only short service messages, such as 'You have a new lead'.
Location: United States.
Transfer safeguard: SCCs.
Zoho (business email)
Purpose: the mailbox where emails you send to support@, privacy@, legal@ and [email protected] are received and answered.
Data: your email address, the content of your email and any attachments.
Location: United States.
Transfer safeguard: SCCs.
Apple and Google
Purpose: 'Sign in with Apple' and 'Sign in with Google'; distribution of our iOS and Android apps and app store billing when you buy a subscription in the app; and delivery of push notifications (Apple Push Notification service and Firebase Cloud Messaging).
Data: the name and email address you choose to share when signing in; subscription status and transaction IDs for app store purchases; device push tokens and the text of notifications.
Location: global, including the United States.
Role: for sign-in and app store purchases, Apple and Google act under their own terms as independent controllers rather than on our instructions. For push notifications, they process the push token and notification content only to deliver the notification to your device, under their developer terms.
Meta (Instagram)
Meta is the platform you connect, not a subprocessor. When you connect Instagram, data flows between IGP one and Meta under Meta's Platform Terms and your permissions. We use Instagram data only to provide the Service to you, and we delete it when you disconnect or ask us to.