Sub-processors
Last updated: 14 August 2026 Version 2026-08-14 Nord it, UAB
Third-party providers Send4.ai uses to deliver the service.
What this list is
Send4 uses the following sub-processors to provide the platform. Each processes personal data only for the purpose listed, under a data processing agreement with us. Where a provider processes data outside the European Economic Area, transfers are protected by the safeguards shown — see our Privacy Policy for how international transfers work.
Current sub-processors
| Provider | Purpose | Personal data | Location | Transfer safeguard |
|---|---|---|---|---|
| OpenAI Ireland Ltd. (OpenAI OpCo, LLC) | AI reply generation | Message content and conversation context sent to generate replies | United States (EU data residency available; not currently enabled) | DPA with SCCs. OpenAI is not certified under the Data Privacy Framework, so SCCs are the sole safeguard. API data is not used to train OpenAI models; abuse-monitoring logs are retained for up to 30 days. |
| Twilio Ireland Limited (Twilio Inc.) | SMS delivery | Lead phone numbers, message bodies, delivery metadata | United States | DPA with EU-U.S. Data Privacy Framework (Twilio Inc., active), Binding Corporate Rules approved by EU authorities, and SCCs as fallback. |
| Vonage B.V. (Vonage Holdings Corp.) | SMS delivery | Lead phone numbers, message bodies, delivery metadata | Netherlands / United States | DPA with EU-U.S. Data Privacy Framework (Vonage Holdings Corp., active) and SCCs as fallback. |
| Resend (Plus Five Five, Inc.) | Transactional email | User names and email addresses, email content | United States (account data, logs and metadata are stored in the US even when an EU sending region is used) | DPA with SCCs. Resend also holds an EU-U.S. Data Privacy Framework listing, but we rely on the SCCs in its DPA as the primary safeguard. |
| Stripe Payments Europe, Limited (Stripe, LLC) | Subscription billing and card payments | Billing contact name and email address, the invoicing details you enter (company name, VAT number, address), plan and billing cycle, and subscription and payment history. Card details are entered directly with Stripe and never reach Send4's systems. | Ireland / United States | DPA with EU-U.S. Data Privacy Framework (Stripe, LLC — certified, with the UK Extension) and Stripe's Data Transfers Addendum incorporating SCCs as fallback. For customers in Europe the contracting entity is Stripe Payments Europe, Limited (Ireland). Stripe also acts as a controller in its own right for payment processing, fraud prevention and its own legal obligations, under its own privacy policy. This covers billing data of our own customers — no lead or conversation data is sent to Stripe. |
| Cloudflare, Inc. | Bot protection (Turnstile), CDN and edge security | IP addresses, request metadata | Global edge network | DPA with EU-U.S. Data Privacy Framework (Cloudflare, Inc., active), with SCCs as fallback. |
| Google Ireland Limited (Google LLC) | “Continue with Google” sign-in | Google profile name, email address, account identifier | EU / United States | Not a sub-processor: for Google sign-in, Google acts as an independent controller under its own privacy policy. Transfers to Google LLC (US) are covered by the EU-U.S. Data Privacy Framework (active). |
| DigitalOcean, LLC | Application hosting and managed database | All platform data (encrypted at rest) | European Union — Frankfurt, Germany (fra1) | DPA with EU-U.S. Data Privacy Framework (DigitalOcean, active), with SCCs and the UK Addendum as fallback. Data is hosted in the EU; DigitalOcean is a US company and its support staff may access it, which is what the DPF and SCCs cover. |
| Plausible Insights OÜ | Privacy-friendly, cookie-less web analytics | Aggregated page-view statistics; no persistent identifiers | European Union (Estonia / EU hosting) | EU-based processing — no third-country transfer. |
Changes to this list
We will update this page before engaging a new sub-processor that handles customer personal data, and customers with a data processing agreement will be notified with 30 days to object as set out in that agreement. Questions: [email protected].
Questions about this page? Email [email protected].