Workspace369 LLC ("Workspace369") uses the companies below to provide the Service. Where we act as a processor of Workspace Content for our customers (see our Data Processing Addendum), these companies are our sub-processors.
Changes. We will post a new sub-processor here, or a change of purpose or location, at least 30 days before it starts handling customer personal data. We email the owner of each workspace at the same time. A customer may object in the way set out in section 7 of the DPA.
Where data is stored. Our primary database (Google Cloud Firestore) is in the United States (South Carolina, us-east1). Our application servers (Google Cloud Functions) run in the United States (mostly Iowa, us-central1). The service is currently not offered with EU or UK data hosting.
| Sub-processor | What it does for us | Personal data involved | Location | Transfer mechanism |
|---|---|---|---|---|
| Google LLC (Google Cloud and Firebase: Firestore, Cloud Storage, Cloud Functions, Cloud Tasks, Cloud Run, Secret Manager, Cloud KMS, Firebase Authentication, Firebase App Check, Firebase Cloud Messaging, Firebase App Hosting) | Hosting, database, file storage, sign-in, push notifications, background jobs, encryption keys, security checks | All Service data: account data, Workspace Content (including files), end-client data, logs | United States (Firestore us-east1; functions and most other services us-central1) | Google Cloud Data Processing Addendum, which includes Standard Contractual Clauses |
| Google LLC (Vertex AI, Gemini models) | AI features: Ask AI, AutoPilot, summaries, drafting, transcription of call and voicemail audio, content moderation | The prompt and the Workspace Content a user sends to an AI feature, including call and voicemail audio and transcripts | United States. Most AI calls use the us-central1 region. Ask AI and MCP calls use Google's global endpoint, which Google may serve from any region where it operates | Google Cloud DPA with SCCs. Google states it does not use customer data to train its models without permission |
| Google LLC (Google Search grounding in Vertex AI, Ask AI web research and client follow-up drafts) | Optional web research inside AI answers | Search query text generated from the prompt | United States / global | Same as above |
| Google LLC (Firebase Analytics, Crashlytics, Performance Monitoring, in our mobile and web apps) | Usage statistics, crash reports and performance traces | App events, device identifiers, device model and OS, IP-derived approximate location, crash logs | United States / global | Google data processing terms with SCCs |
| Google LLC (Firebase Phone Authentication and reCAPTCHA) | Delivering and verifying phone one-time codes for sign-in and multi-factor authentication; bot checks on some sign-in pages | Phone number, one-time code, IP address, device signals | United States / global | Google data processing terms with SCCs |
| Typesense, Inc. (Typesense Cloud, 3-node cluster) | Search index for workspace search (clients, inbox, notes, tasks) | Searchable fields of workspace records, tenant-scoped | United States (Amazon Web Services, us-east-1) | Typesense's data processing terms |
| Self-operated ClamAV service on Google Cloud Run | Malware scanning of inbound email attachments (Specialist, Commander and Enterprise plans) | Attachment bytes, scanned in our own project, not shared with anyone else | United States (us-central1) | Not a separate sub-processor. It is part of our Google Cloud infrastructure |
| Sub-processor | What it does | Personal data | Location | Transfer mechanism |
|---|---|---|---|---|
| Stripe, Inc. (Stripe Billing, Checkout, Payment Element, Connect, Radar) | Subscription billing; payments a customer accepts from its own clients through Stripe Connect; fraud screening | Billing contact, card details (entered directly with Stripe; we do not receive card numbers), payment and payout metadata, invoice amounts | United States, with global processing | Stripe DPA with SCCs |
| RevenueCat, Inc. | Managing subscriptions bought through the Apple App Store and Google Play | App user ID, purchase and entitlement records | United States | RevenueCat DPA with SCCs |
| Apple Inc. and Google LLC (App Store and Google Play billing) | Processing in-app purchases and sign-in with Apple / Google | Purchase receipts, account identifiers, relay email | United States / global | Apple and Google developer terms; they act as independent controllers for their own store accounts |
| Sub-processor | What it does | Personal data | Location | Transfer mechanism |
|---|---|---|---|---|
| Twilio Inc. (SMS, MMS, Voice, call recording, Verify, per-workspace subaccounts) | Sending and receiving texts and calls for workspaces; phone verification at sign-up; call recording (on by default for plans that include it; a workspace admin can turn it off) | Phone numbers, message content, call audio and recordings, voicemail, delivery metadata | United States, with global carrier networks | Twilio DPA with SCCs |
| Twilio SendGrid (Twilio Inc.) | Sending and receiving email, inbound email parsing, delivery events | Email addresses, message content and attachments, delivery metadata | United States | SendGrid DPA with SCCs |
| Microsoft Corporation (Microsoft Graph, Microsoft Entra sign-in) | Outlook and Microsoft 365 mailbox connections a user chooses to enable | Mailbox messages and metadata the user connects, OAuth tokens | United States / global | Microsoft Products and Services DPA with SCCs |
| Google LLC (Google Calendar and Google Meet APIs) | Calendar and Meet connections a user chooses to enable | Calendar data the user connects, OAuth tokens (see Limited Use statement in our Privacy Policy) | United States | Google DPA with SCCs |
| Customer-chosen mail servers (IMAP) | Reading mail from a mailbox a user connects by IMAP | Mailbox messages, credentials supplied by the user | Wherever the user's mail host is | The user directs the connection. Not our sub-processor |
| Sub-processor | What it does | Personal data | Location | Transfer mechanism |
|---|---|---|---|---|
| Cloudflare, Inc. (Turnstile) | Bot check on e-signature code requests and public booking pages | IP address, browser signals, challenge token | Global | Cloudflare DPA with SCCs |
| Google LLC (Safe Browsing / Web Risk) | Checks links found in inbound email against Google's list of dangerous sites | The URLs found in inbound messages (not the message text) | United States / global | Google terms |
| Recipient | What it does | Personal data | Location |
|---|---|---|---|
| Meta Platforms, Inc. (Graph API) | Importing leads from Meta Lead Ads a customer connects | Lead form answers | United States |
| Google LLC (Maps Platform Places API) | Address search and autocomplete | Address text typed into search | United States / global |
| Giphy, Inc. | GIF search in the message composer | Search words the user types | United States |
| AI clients a user connects (for example Claude, ChatGPT, Grok through our MCP connector) | The user's chosen AI app reads and edits workspace data with the user's approval | Whatever the user lets that client access | Set by the AI client provider |
The last row is not our sub-processor. The user decides to connect it and can revoke it any time.
These apply to visitors of workspace369.com and to our own advertising, not to customer data in the Service. See the Cookie Policy.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Netlify, Inc. | Hosting workspace369.com | Visitor IP address, request logs | United States |
| Google LLC (Google Analytics 4, Google Ads) | Website analytics and ad conversion measurement (after consent where required) | Cookie IDs, page views, conversions | United States / global |
| Microsoft Corporation (Clarity) | Session replay and heatmaps (after consent where required) | Page interactions, masked content | United States / global |
| Ahrefs Pte. Ltd. | Website traffic analytics (after consent where required) | Page views, IP-derived data | Singapore / global |
| Meta Platforms, Inc. (Pixel and Conversions API) | Measuring our own ads | Browser IDs, conversion events, hashed email or phone | United States / global |
| Rewardful, Inc. | Affiliate referral tracking | Referral cookie, affiliate and sign-up IDs | United States / global |
Sentry, Mixpanel, PostHog, Segment, Intercom, HubSpot, OpenAI, Anthropic API, Mailgun and Algolia are not used to process Service data. Algolia inbox search has been retired.
TypeSafe, Inc. ("Jev" decision model for AutoPilot). For some workspaces, AutoPilot sends inbox item titles and short previews to TypeSafe. We have not yet confirmed its location or written no-training terms, and we are moving AutoPilot to Google Vertex AI, after which this entry will be removed.