Sub-processors
Draft. This page has been written by us and has not yet been reviewed by a lawyer. What each provider does for us, and what data reaches it, are our own facts and we stand behind them. The transfer mechanisms are not ours: they are the instruments the providers publish, we have not yet checked each one against its provider's current terms, and the last column says so row by row rather than pretending otherwise.
Last updated: 8 August 2026.
These are the third parties that process data on our behalf when you use Findkeep. "Sub-processor" is the term the GDPR uses for a processor engaged by another processor; clause 4 of the Data Processing Agreement is where your rights over this list live.
| Sub-processor | What it does for us | Data that reaches it | Where it processes | Transfer mechanism |
|---|---|---|---|---|
| Google LLC Places API live |
Runs the business searches you type and returns the listings that become your leads. | The search text you enter and our server's request. Google does not receive your leads, your notes or your account details. | United States and Google's global infrastructure. | Google's own data processing terms, which we understand to rely on the Standard Contractual Clauses. Being confirmed — see the note under the table. |
| Stripe, Inc. payments live |
Takes payment, hosts the checkout and the customer portal, and tells us when a subscription changes. | Your email address, billing name and address, card details (entered directly with Stripe — they never pass through our server), and your subscription and seat count. | United States and Ireland. | Stripe's data processing agreement, which we understand to rely on the Standard Contractual Clauses. Being confirmed — see the note under the table. |
| Our hosting provider name to be published — see the note below live |
Runs the server the application and the database sit on, and keeps the web server's access logs. | Everything, as the custodian of the disk: your account data, your leads, and the nightly backups. | United States. | The provider's own terms. Being confirmed together with the provider's name — see the note under the table. |
| Brevo transactional email not yet in use |
Would deliver the three emails the product sends: signup verification, password reset and team invitation. | The recipient's email address and the contents of that message. No leads, ever. | European Union (France). | No third-country transfer; processing stays in the EU. |
| Resend transactional email, alternative not yet in use |
The second supported email backend. Only one of Brevo and Resend is ever active. | The recipient's email address and the contents of that message. No leads, ever. | United States. | Resend's data processing agreement, which we understand to rely on the Standard Contractual Clauses. Being confirmed — see the note under the table. |
| Cloudflare, Inc. Turnstile anti-bot not yet in use |
Would check that a form was filled in by a person rather than a script. Two places, and no others: creating an account, and the form on the data request page. It is on no page a signed-in customer uses. | The visitor's IP address and browser signals at the moment the form is submitted. | United States and Cloudflare's global network. | Cloudflare's data processing addendum, which we understand to rely on the Standard Contractual Clauses. Being confirmed — see the note under the table. |
| Off-site backup storage not yet in use |
Would hold a second copy of the nightly database snapshot away from the main server. | A full copy of the database, which is everything. | Not applicable while unconfigured. | To be named here before it is switched on. |
Why the last column says "being confirmed". For a transfer to the United States the usual instrument is the Standard Contractual Clauses, and each provider above publishes data processing terms that name one. Some providers now rely on the EU-US Data Privacy Framework instead. We have not yet read each provider's current terms end to end, and naming the wrong instrument in our own table would be worse than saying we are still checking. As each is confirmed the row will name the instrument and link to the terms it comes from. Until then the last column is our understanding, not a verified statement, and if the answer matters to your own assessment, ask us and we will tell you where the check has got to.
Why two email providers and a hosting provider with no name. The product supports Brevo and Resend and neither is switched on: today it sends no email at all. Both are listed so that the day one is enabled is not the day this page becomes wrong. The hosting entry is real and live — the server exists and holds the data — but we are not publishing the provider's legal name and DPA link until we have confirmed both; an entry with an honest gap in it is better than a guess. It is on the list of things to settle before this page stops calling itself a draft, and if you need the name before then, ask us and we will tell you.
When this list changes
Before a new sub-processor starts processing your data, we will give at least 30 days' notice by email to every account owner, and update this page with the change and its date. If you object on reasonable data-protection grounds within that period and we cannot resolve it, you may terminate the affected part of the Service and get back what you have paid for the unused period. That commitment is clause 4 of the Data Processing Agreement.
Removing a sub-processor, or replacing one with another on the same footing, does not need notice, but we will still record it here.
Not sub-processors
Two things people expect to find on a list like this and will not:
- No analytics or advertising. There is no analytics product, tag manager, session recorder or advertising pixel anywhere in Findkeep. That is not an oversight in this table; there is nothing to list.
- No AI or model-training vendor. Your leads and notes are not sent to any model, ours or anyone else's.
← Privacy Policy · Data Processing Agreement · Back to Findkeep