About this list
Sendpilot AI AB (org. no. 559528-8447), a Swedish limited company, provides the Sendpilot platform and the website sendpilot.ai. A sub-processor is a third-party provider that we engage to help deliver the Sendpilot platform and that processes Customer Personal Data, such as the leads and conversations in your workspace, which we process on your behalf as your processor. This page lists those providers, followed by the services that support our website and marketing.
Customer data in the Sendpilot platform is stored primarily in the EU, on Microsoft Azure in the Sweden Central region, and is encrypted at rest and in transit. Where a provider below processes personal data outside the European Economic Area (EEA), the table names the safeguard that covers the transfer.
This page is the Sub-processor Page referred to in the Data Processing Addendum (DPA) in our Terms of Service, and our Privacy Policy refers to it for the service providers that process personal data for us.
Platform sub-processors
These providers process personal data in the Sendpilot platform: Customer Personal Data in your workspace, and account data about you and your team. Section 6 of the DPA requires us to bind each of them to data protection terms that meet the standard the GDPR sets, and we remain responsible for their processing.
| Sub-processor | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Microsoft Azure (Microsoft Ireland Operations Limited) | Hosting of the Sendpilot platform, its databases and the data in your workspace | EU (Azure region Sweden Central) | Processed in the EU |
| Azure OpenAI Service (Microsoft Ireland Operations Limited) | AI processing for ICP scoring of LinkedIn profiles, drafts of posts and lead magnets, and AI draft replies in the inbox. Not used to train models. | Microsoft data centres, which may be outside the EU | EU-U.S. Data Privacy Framework and Standard Contractual Clauses |
| Anthropic (Anthropic Ireland, Limited) | AI processing for the same features: ICP scoring, drafts of posts and lead magnets, and AI draft replies in the inbox. Not used to train models. | United States and other countries | Standard Contractual Clauses |
| LinkupAPI (LINKUPAPI SAS, France) | Connects your LinkedIn accounts to Sendpilot, carries out the actions in your sequences and inbound automations, syncs your conversations, and provides each account's dedicated proxy unless you bring your own | EU (data stored in Austria and Finland). Network and proxy traffic may be routed through the EU, the United States and the country of the connected LinkedIn account. | Processed in the EU; Standard Contractual Clauses for any transfer outside the EEA |
| Clerk (Clerk, Inc.) | Sign-up, sign-in and sessions for the platform, and the OAuth connection for AI assistants you connect over MCP | United States | EU-U.S. Data Privacy Framework and Standard Contractual Clauses |
| Svix (Svix Inc.) | Delivery of the webhooks you set up to your own endpoints. Payloads can contain lead and message data. | United States | Standard Contractual Clauses |
| Resend (Plus Five Five, Inc.) | Delivery of emails from the platform to you and your team | United States | EU-U.S. Data Privacy Framework and Standard Contractual Clauses |
| Intercom (Intercom R&D Unlimited Company) | Support chat in the platform and on our website, and the history of your support conversations | United States | EU-U.S. Data Privacy Framework and Standard Contractual Clauses |
| Stripe (Stripe Payments Europe, Limited) | Subscription billing and payments. Stripe is also an independent controller for fraud prevention and its own legal obligations as a payment provider. | United States and other countries | EU-U.S. Data Privacy Framework and Standard Contractual Clauses |
Customer data is never used to train AI models, whether ours or our AI providers'.
Website and marketing services
These services support sendpilot.ai and our marketing. They process data about visitors to our website, such as IP address, device and browser details, the pages you view and what you enter in a form, rather than the data in your Sendpilot workspace. We do not upload customer or lead lists to any advertising platform, and the data in your Sendpilot workspace and its integrations is never used for advertising or sold.
| Service | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Vercel (Vercel Inc.) | Hosting and delivery of sendpilot.ai, including the forms submitted on it | United States, with a global edge network | EU-U.S. Data Privacy Framework and Standard Contractual Clauses |
| Cloudflare (Cloudflare, Inc.) | DNS, TLS, content delivery, and protection against attacks and bots | Global network, including outside the EU | EU-U.S. Data Privacy Framework and Standard Contractual Clauses |
| Google Analytics 4 and Google Tag Manager (Google Ireland Limited) | Website analytics, and loading the tags on our website | United States and other countries | EU-U.S. Data Privacy Framework and Standard Contractual Clauses |
| Meta Pixel (Meta Platforms Ireland Limited) | Measuring Sendpilot's own ads, and showing them to people who have visited our website | United States and other countries | EU-U.S. Data Privacy Framework and Standard Contractual Clauses |
| Microsoft Clarity (Microsoft Ireland Operations Limited) | Session recordings and heatmaps that show how visitors use our website | United States | EU-U.S. Data Privacy Framework and Standard Contractual Clauses |
| CookieYes (CookieYes Limited, United Kingdom) | The cookie banner, and the record of your consent choice | United Kingdom and EU, with support access from India | EU adequacy decision for the United Kingdom; Standard Contractual Clauses in CookieYes's data processing terms |
| Calendly (Calendly LLC) | Booking calls with our team | United States | EU-U.S. Data Privacy Framework and Standard Contractual Clauses |
| Resend (Plus Five Five, Inc.) | Delivery of the messages you send through the contact forms on our website to our team | United States | EU-U.S. Data Privacy Framework and Standard Contractual Clauses |
Google Analytics, Microsoft Clarity and the Meta Pixel only load once you have accepted them in the cookie banner. You can change or withdraw your choice at any time with the Cookie settings link in the footer of our website, and our Cookie Policy has more detail.
Some of these providers also decide for themselves how they use the data they collect. Meta is a joint controller with us for collecting Pixel data on our website and transmitting it to Meta, and Meta is responsible for what it does with that data after it receives it. Microsoft acts as a controller for Clarity data, and Calendly is an independent controller for the cookies on its booking pages. Their own privacy policies apply to that use.
Integrations you choose
Some services receive data from Sendpilot only because you connect them and instruct us to send it. They are your own services, used under your own terms with each provider, so they are not our sub-processors:
- HubSpot. When you connect a HubSpot account, Sendpilot reads and writes its contacts, companies and deals.
- Slack. Alerts, for example on every new reply, are posted to the Slack channel you pick.
- Your webhook endpoints and API clients. Webhook events, which can include lead and message data, go to the URLs you configure, delivered through Svix (listed above). Your own applications reach your workspace through the Sendpilot API, using the API keys and scopes you create.
- AI assistants you connect over MCP. If you connect Claude, ChatGPT, Grok or another assistant to your workspace, through OAuth or an API key, it can read and act on your workspace data, and its provider processes that data under your own agreement with them.
- LinkedIn. The connection requests, messages and other actions you run are carried out on your own LinkedIn accounts, under LinkedIn's terms with you.
Disconnecting HubSpot, Slack or a LinkedIn account stops the sync immediately and deletes the data that came through that integration, including its access tokens. The Privacy Policy explains how long other data is kept.
Changes to this list
We keep this page up to date. Under section 6.3 of the DPA, we notify customers in the Sendpilot platform at least 10 days before we add or replace a sub-processor. If you object to a new sub-processor within 30 days of that notice, on reasonable grounds relating to the protection of your Customer Personal Data, we will work with you in good faith to find an alternative. If we cannot find one, you may terminate the agreement at no additional cost.
Questions about this list or about how we handle personal data can be sent to hello@sendpilot.ai, or by post to Sendpilot AI AB, Danderydsgatan 28A, 114 26 Stockholm, Sweden.