Sub-processors
Running a platform means relying on other companies for hosting, payments, delivery and similar services. Some of them may process personal data on our behalf. This page lists what each of them does, so you can assess them, and so your privacy team has the answer without having to ask.
The short version
- Every provider is contractually limited to providing its service to us.
- None of them may use your data for their own purposes, sell it, or train models on it.
- Providers you connect yourself are marked as customer-directed, and disconnecting them stops the processing.
- We give 30 days’ notice before the list changes, and you can object.
This summary is for convenience only. The numbered sections below are the binding text.
01How to read this page
A sub-processor is a company we engage that may process personal data in the course of helping us deliver the Service. This page exists so that you can see who they are, decide whether you are comfortable with them, and object if you are not. It is referenced by our Data Processing Addendum and forms Annex III of the Standard Contractual Clauses incorporated there.
- Every provider below is engaged under a written contract that limits them to providing their service to us.
- None of them is permitted to use your data for their own purposes, to sell it, or to train models on it.
- Providers used only because you chose to connect them are marked as customer-directed. They process data because of your configuration, and disconnecting them stops that processing.
02Infrastructure and platform operations
| Role | What it processes | Region |
|---|---|---|
| Application hosting and compute | Hosts the application and the database that holds your workspace. Processes all workspace data at rest and in transit. | European Union |
| Network, DNS and edge protection | Routes and protects traffic to our domains. Processes connection metadata such as IP address and request headers. | Global edge network |
| Object and file storage | Stores files you upload, exports you generate, and backups. | European Union |
| Error monitoring and platform diagnostics | Receives technical error reports and performance measurements, which may incidentally include identifiers present in a failing request. | European Union / United States |
03Payments
| Role | What it processes | Region |
|---|---|---|
| Payment processing and subscription billing | Collects and processes your payment method, billing address and tax status directly. We receive invoice and subscription records only, never full card numbers. | European Union / United States |
Your payment card details are handled by the payment processor under its own agreement with you and under card-scheme rules. They do not pass through, and are not stored by, the Leads Ranger application.
04Message delivery and channels
| Role | What it processes | Region | Basis |
|---|---|---|---|
| Transactional email delivery | Sends the emails the platform itself sends you: verification, password reset, alerts, billing notices. | European Union | Platform |
| Outbound email through your own mailbox | Your connected mailbox provider (for example Microsoft 365, or any provider you connect over standard mail protocols) transmits the outreach you send. Content and recipient details pass through that provider. | Determined by your provider | Customer-directed |
| Messaging gateway | Transmits messages on messaging channels you enable, including recipient number and message content. | European Union / United Kingdom | Platform, enabled by you |
05Artificial intelligence providers
| Provider | What it processes | Basis |
|---|---|---|
| OpenRouter | Routes generation requests to the model selected for your workspace. Receives the prompt content needed to produce the output. | Platform or your own key |
| Google (Gemini) | Generates content from the prompt content sent to it. | Platform or your own key |
| DeepSeek | Generates content from the prompt content sent to it. | Platform or your own key |
No training on your data
Each AI provider is engaged on terms that prohibit training on the content we send. If you supply your own provider key, that traffic runs under your own agreement with that provider instead, and you control its terms directly.
06Data discovery and verification
| Role | What it processes | Basis |
|---|---|---|
| Business discovery sources | Returns publicly available business listing information in response to a search you run. Receives your search criteria, not your workspace contents. | Platform, triggered by you |
| Contact validation | Checks whether an address is likely to accept mail before you send to it. Receives the address being checked. | Platform, triggered by you |
07Business operations
| Role | What it processes | Region |
|---|---|---|
| Customer support tooling | Stores support conversations and any information you include in them. | European Union |
| Internal collaboration and document storage | May incidentally hold customer names and correspondence in the ordinary course of running the business. | European Union / United States |
08Changes and objections
- We give at least 30 days’ notice before adding or replacing a sub-processor, by updating this page.
- To be notified by email as well, write to support@leadsranger.com with "Sub-processor notifications" in the subject line and we will add your address to the list.
- If you have a reasonable, documented data protection objection to a new sub-processor, tell us within the notice period. We will work in good faith to offer an alternative, and if we cannot, you may terminate the affected part of the Service and receive a pro-rata refund of prepaid, unused fees.
- To request the current registered entity name and address of any provider listed here, write to support@leadsranger.com.