Sub-processors | BuyerPro

The short version

These are every third party that can touch data you send to BuyerPro. We give customers 30 days' notice before adding to this list, as our Data Processing Agreement requires.

To be told about changes, email [email protected] with the subject "Subscribe to sub-processor notices".

Before publishing: sign each provider's standard DPA, confirm the actual hosting region for each, and record the transfer mechanism each one offers. Then replace the "To confirm" entries in the last column with what is genuinely in place. Do not publish an unverified transfer mechanism — a wrong entry here is worse than no page.

Current sub-processors

Each entry states what the provider does for us, what data it can reach, and where it processes it.

Provider	Purpose	Data it can access	Location	Transfer mechanism
Anthropic PBC	The AI model that reads supplier threads and drafts coaching	Email content submitted for analysis. Not used to train models.	United States	To confirm — SCCs / UK Addendum via Anthropic's commercial terms
DigitalOcean LLC	Application hosting and managed PostgreSQL database	Encrypted message content, email addresses, account and billing records	United States (NYC region)	To confirm — SCCs / UK Addendum via DigitalOcean DPA
Cloudflare, Inc.	Website hosting, DNS, email routing for `[email protected]`, and edge security	Inbound messages in transit; website request logs	United States, with global edge network	To confirm — SCCs / UK Addendum via Cloudflare DPA
Postmark (ActiveCampaign, LLC)	Sending outbound coaching, trial and service email	Recipient addresses and the content of email we send	United States	To confirm — SCCs / UK Addendum via Postmark DPA
Stripe, Inc.	Subscription billing and payment processing	Billing contact and payment details, held by Stripe. BuyerPro never sees card numbers.	United States	To confirm — SCCs / UK Addendum via Stripe DPA
Telegram FZ-LLC	Operational alerts to the BuyerPro team	Signup notifications and system error alerts. No message content.	United Arab Emirates / global	To confirm — see note below

Open item on Telegram. Trial signup alerts currently include the signup email address and IP address. Telegram is a consumer messaging service with no enterprise DPA, which makes it the weakest link on this page. Either strip personal data from those alerts so only counts are sent, or move alerting to a provider that will sign a DPA. Until one of those is done, this row will not survive enterprise diligence.

What we do not use

It is worth being explicit about the categories that are absent:

No analytics or advertising. No Google Analytics, no advertising pixels, no attribution or session-recording tools. Our website sets no cookies at all.
No data brokers or enrichment. We do not buy contact data and we do not enrich what you send us from outside sources.
No other AI providers. Anthropic is the only model provider your content reaches.
No CRM or marketing automation platform holding your correspondence.

How we notify changes

Before a new sub-processor starts handling customer data we will email account holders who have subscribed to notices and update this page, in both cases at least 30 days in advance.

If you have a reasonable data protection objection, tell us within those 30 days. We will work with you on an alternative, and if we cannot find one you may terminate the affected part of the service without penalty and receive a pro-rata refund of prepaid fees. The full mechanism is clause 6 of the Data Processing Agreement.

Change log

Date	Change
3 September 2026	First published.