Subprocessors
The companies we rely on to run CommsOperator, listed by name, what each does, the data it sees, and the country it runs in, plus how to get 30 days' notice of changes.
- Version
- 2.0
- Effective
- 2026-08-26
- Last updated
- 2026-08-26
- Provider
- WomenTech LLC
In short: these are the companies we rely on to run CommsOperator, listed by name, job, data, and country. Core providers touch every customer. Optional ones only run when you turn on that feature or integration. We give at least 30 days' notice before adding or replacing one, and you may object. To receive notices, email privacy@commsoperator.com. In short boxes are a plain-language guide. If a summary and the full text differ, the full text applies.
This page lists the subprocessors that may process personal data on behalf of CommsOperator customers. Each is bound by a written contract with data protection terms no less protective than our data processing addendum. We remain responsible for their performance.
We give at least 30 days' notice before adding or replacing a subprocessor. To receive notices, email privacy@commsoperator.com with the subject "subprocessor notices". Customers may object on reasonable data protection grounds under section 7 of the DPA.
How to read the tables: each row names the provider, what it does for you, the data it sees, and where it runs.
Core subprocessors (all customers)
In short: these run for every customer. Hosting in Germany, the database in Frankfurt, AI on the OpenAI API in the US, billing through Stripe, certificates from Let's Encrypt, plus Clarity analytics and Google Fonts on the shared application shell.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Hetzner Online GmbH | Runs the application servers and stores the files you upload | All customer data processed by the application, and uploaded files | Germany (EU). United States for a dedicated US instance. |
| Neon Inc. (managed PostgreSQL) | Holds the database and its backups | All customer data at rest | AWS eu-central-1, Frankfurt, Germany. A US region for a dedicated US instance. |
| OpenAI, L.L.C. | Runs the AI: sorting conversations, drafting replies, writing summaries, and the embeddings behind search | The conversation, knowledge content, and CRM fields needed for the requested task. Not used to train OpenAI models under its API data usage policy. | United States |
| Stripe, Inc. | Handles subscription billing and card payments | Billing contact and subscription data. Card details go directly to Stripe and are never stored by us. | United States and Ireland |
| Let's Encrypt (Internet Security Research Group) | Issues the TLS certificates that encrypt traffic to the service | Domain names only, no personal data | United States |
| Microsoft Corporation (Clarity) | Shows us which pages work and where people get stuck, with advertising and analytics storage denied by default. It loads from the one application shell, so it runs on the marketing website and on signed-in application pages. | Page views, coarse device data, and interaction events, including on authenticated application pages | United States |
| Google LLC (Google Fonts) | Serves the web fonts for the marketing website, the signed-in application, and the public booking pages your invitees open. | IP address and user agent when a font is fetched | United States and European Union |
Optional subprocessors (only when the feature or integration is enabled)
In short: these see data only when you switch on the feature: your Microsoft 365 tenant, error monitoring, meeting bots, contact enrichment, newsletter delivery, push notifications, fund CRM sync, and email verification.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Microsoft Corporation (Microsoft 365, Graph, Teams, Entra) | Reaches the mailboxes, calendars, and Teams of the Microsoft tenant you connect, through the Entra app registration your admin consents to | Mail, calendar, and Teams content the customer authorizes; OAuth tokens | The customer's own Microsoft tenant region |
| Functional Software, Inc. (Sentry) | Catches errors and slow requests so we see a fault before you report it | Error events with personal data stripped; user identifiers only where the customer enables it | United States or European Union depending on the configured region |
| Recall.ai | Sends a meeting bot to record and transcribe the externally hosted calls you choose | Meeting audio, video, and transcripts for meetings the customer selects | United States or European Union depending on the configured region |
| Apollo.io | Fills in contact and company details when you ask for enrichment | The name, email domain, or company identifier submitted for enrichment | United States |
| Amazon Web Services (Simple Email Service) | Delivers newsletters and transactional email when you pick it as the provider | Recipient address, message content, delivery events | The AWS region the customer selects |
| Brevo (Sendinblue SAS) | Delivers newsletters and keeps list history when you use Brevo | Recipient address, message content, delivery and suppression events | European Union |
| Mail Flow (Tech Family Ventures) | The default newsletter delivery gateway; it also handles suppression and delivery events | Recipient address, message content, delivery events, suppression records | Germany (EU) |
| Google LLC (Firebase Cloud Messaging) | Delivers push notifications to phones and desktops | Device push tokens and notification payload titles | United States |
| Decile Hub | Keeps a venture fund's system of record in step with CommsOperator, for funds that use it | People, organizations, pipelines, prospects, files, and events the customer syncs | United States |
| Reoon | Checks whether email addresses are deliverable when an operator asks for a list to be verified before a campaign | Email addresses submitted for verification | European Union |
Website only
In short: no provider is website-only today. Clarity and Google Fonts sit under core because one application shell serves both the marketing website and the signed-in application.
| Provider | Purpose | Data | Location |
|---|
Dedicated instances
In short: a dedicated instance uses the same core providers in the region you choose, unless your order form names different ones.
A dedicated instance uses the same core subprocessors in the region you choose, unless the order form names different providers. Optional subprocessors are enabled only where you enable the corresponding feature.