Sub-Processors
Last changed: 23 September 2026
A sub-processor is a company we use to run part of Chatleadr, which as a result processes personal information on behalf of our Customers. This page is the list referred to in clause 6 of the Data Processing Terms and in section 8 of the Privacy Policy.
It lives on its own page so that it can be kept current without amending a contract. A list that is out of date is worse than no list, because a Customer audits against it.
Current Sub-Processors#
| Sub-processor | What it does | What it receives | Where it processes |
|---|---|---|---|
| OpenAI | Generates the bot's replies and classifies visitor intent | Conversation messages, the bot's configuration and knowledge documents | United States |
| Akamai (Linode) | Hosts the application and the database | Everything stored by the service | London, United Kingdom |
| Akamai (Linode Object Storage) | Stores uploaded documents as encrypted objects | Files uploaded through a form, encrypted before they leave our servers | London, United Kingdom |
| Google (Firebase Authentication) | Signs Customers in | Customer email address and account identifier. No visitor data | United States |
| Zernio | Delivers messages on WhatsApp and Instagram | Messages on those channels, and the visitor's account identity on them | Western Europe, with global edge processing and logging in the United States |
| Postmark | Delivers lead notification emails and account emails such as workspace invitations | A lead's name, email address, phone number, the page they arrived on and a summary of their conversation; the address the notification is sent to | United States |
Each of these is engaged under a data processing agreement giving the data protection obligations described in clause 6 of the Data Processing Terms, and, where the recipient is outside the European Economic Area, incorporating the European Commission's Standard Contractual Clauses. Section 9 of the Privacy Policy covers the cross-border position in full.
Zernio is stated less precisely than the others, and deliberately so. Zernio is a Spanish company and its published infrastructure is Western European by default, but it does not publish a processing location specific to message content, and it describes its own default as not being a country-specific or EU-only guarantee. The entry above is what Zernio itself discloses rather than a commitment we can make on its behalf. If a Customer needs a firmer location for WhatsApp or Instagram messages than that, email support@chatleadr.com and we will ask Zernio for it in writing.
Not Sub-Processors, and Why#
Two services appear near the product and are not on the list above. The distinction matters, because we cannot accept responsibility under clause 6 for a relationship we are not a party to.
Our payment providers are merchants of record, not sub-processors. Each one sells the subscription to the buyer and collects card details directly, and we never receive them. For that information each is a controller in its own right rather than our processor, and its own terms govern it.
Clause 4 of the Terms of Service points here rather than naming a provider, so that changing one is an update to this page rather than an amendment to the agreement. The provider that sold a given subscription is named at checkout and on the receipt for it.
Lemon Squeezy is the provider configured today. Where we add another, it is named here with the date from which it sells, so that every purchase can be matched to the provider that took it.
ClickUp receives lead information only where a Customer has connected their own ClickUp account and switched the integration on. The Customer is instructing ClickUp, using their own credentials.
If a Customer switches on an integration that uses their own credentials, the service behind it becomes the Customer's own processor, not ours.
Email notification is not one of those. It is switched on in the same place, but it runs on our Postmark account and sends from our address. The Customer supplies a destination address and a subject line, not a key. Postmark is therefore our sub-processor and is listed above.
How We Notify Changes#
We give 30 days' notice before a new sub-processor begins processing Customer data. We publish the change here, update the date at the top of this page, and email every Customer on the notification list.
A Customer may object on reasonable data protection grounds within that period. Clause 6 of the Data Processing Terms sets out what happens if we cannot resolve the objection.
To be told when this page changes, email support@chatleadr.com and ask to be added to the sub-processor notification list.