OutreachEU
ITEN
DRAFT – to be reviewed by a lawyer

Version 1

Sub-processor list

Last updated: [DATE]

OutreachEU uses the following sub-processors. We will notify customers at least [30] days in advance of any addition or replacement, with a right to object as set out in the DPA.

Lovable Cloud (Supabase infrastructure) – hosting, database, authentication

  • Provider: Lovable Labs Incorporated [to verify contracting entity], Supabase Inc. infrastructure.
  • Purpose: application hosting, database, user authentication, sending engine.
  • Data: all platform data (accounts, workspaces, contacts, campaigns, delivery logs, inbox messages, encrypted mailbox credentials).
  • Country: European Union – region [TO BE CONFIRMED, e.g. eu-central-1 Frankfurt].
  • Transfer safeguards: [to verify] Standard Contractual Clauses 2021/914 and/or EU-US Data Privacy Framework for any support access from the US.

Lovable AI – text processing

  • Provider: Lovable Labs Incorporated [to verify], using underlying model providers [TO BE CONFIRMED].
  • Purpose: classifying inbox replies, reply drafts, company summaries from public websites, personalised campaign copy.
  • Data: minimised text only: first name, job title, company name and industry, company summary; for the inbox, reply text stripped of signatures, quotes, emails, phone numbers and names. Never email, surname, phone or legal-basis notes.
  • Country: [TO BE CONFIRMED – likely US].
  • Safeguards: [to verify] Standard Contractual Clauses and/or Data Privacy Framework; no use of data for model training [to verify].

Stripe – payments (coming soon)

  • Provider: Stripe Payments Europe Ltd. (Ireland).
  • Purpose: customer subscriptions and payments.
  • Data: customer billing data (legal name, VAT, billing email, payment data). No contact data.
  • Country: EU (Ireland), with possible transfers to Stripe Inc. (US).
  • Safeguards: EU-US Data Privacy Framework and Standard Contractual Clauses.

Customer mail providers

Emails are sent from mailboxes connected by the customer (e.g. Google Workspace, Microsoft 365, Aruba, OVH, IONOS). These providers are chosen and contracted directly by the customer and are not OutreachEU sub-processors.