This page lists the third-party services ("sub-processors") that PRODUCTISED LIMITED uses to process personal data on behalf of its customers, including the information customers' products collect from their own audience ("Leads"). It forms Annex 3 of our Data Processing Agreement.
Each sub-processor is bound by a written contract that protects personal data at least as well as our Data Processing Agreement. Our platform is hosted in the United States. For how we protect transfers from Europe, see our Privacy Policy.
Hosting and storage
- Fly.io, Inc. — hosts the Productised app and Claude connector. Sees all customer and Lead data in transit and in memory. Location: USA (Virginia).
- Supabase, Inc. — the database. Stores all customer and Lead data. Location: USA (Amazon Web Services, us-east-1).
- Cloudflare, Inc. — file storage (R2) and bot protection at sign-up (Turnstile). Sees uploaded files and the visitor's IP address for the bot check. Location: USA and global network.
AI
- Anthropic, PBC — Claude, which runs customers' AI products, writes results, and builds products. Sees Lead conversation content and answers. Location: USA. API data is not used to train models.
- OpenAI, L.L.C. — turns Lead voice recordings into text, powers customer knowledge search ("Brain"), and runs products a customer has set to a GPT model. Sees Lead voice recordings, customers' knowledge content, and conversations on GPT products. Location: USA. API data is not used to train models.
- Supermemory — knowledge-base search inside products. Sees the Lead's question and the knowledge the customer uploaded. Location: USA.
- Parallel Web Systems — web research inside products. Sees the search query built from the conversation. Location: USA.
- Firecrawl (Mendable, Inc.) — web search inside products. Sees the search query built from the conversation. Location: USA.
If a customer adds their own Anthropic API key to a workspace, that workspace's AI conversations run on the customer's own Anthropic account, and Anthropic processes that data for the customer directly. The OpenAI, Supermemory, Parallel and Firecrawl processing above still runs through Productised.
Email, notifications and spam protection
- Postmark (ActiveCampaign, LLC) — transactional email, including new-Lead notifications to customers. Sees the recipient's email and the Lead's name, email and score or segment. Location: USA.
- Novu (Noti-Fire Apps Ltd.) — in-app notifications. Sees customer user identifiers. Location: USA (Novu Cloud, US region).
- Google LLC — reCAPTCHA spam protection on forms and product pages. Sees the visitor's IP address and browser signals. Location: USA.
Billing, analytics and support
- Stripe, Inc. — billing. Sees customers' billing details only, never Lead data. Location: USA.
- Simple Analytics B.V. — cookieless page analytics, including on public product pages. Collects no personal data. Location: EU (Netherlands).
- Grain — product-usage analytics for signed-in customers. Sees customer user and workspace identifiers and which part of the app was used, never Lead data. Location: EU (Frankfurt, Germany).
- Gist — support chat for customers. Sees the customer's name, email and messages. Never loads on public product pages. Location: USA (Amazon Web Services, us-east-1).
Changes to this list
We tell customers by email at least 30 days before we add or replace a sub-processor, and update this page. Customers can object on reasonable data protection grounds, as set out in our Data Processing Agreement.
To be told about changes, email privacy@productised.ai with the subject "Subscribe to sub-processor updates". Account owners on a signed Data Processing Agreement are notified automatically.
