Sub-processors
Last updated: October 14, 2026
SalesLobe (Den Hartogh Solutions, KVK 93891237) engages the sub-processors listed below. This list is Annex B of our Data Processing Agreement. Workspace data is stored in the EU (AWS eu-north-1, Stockholm); AI inference, billing and error monitoring run through sub-processors, some of them partly in the US under Standard Contractual Clauses (SCCs) or the EU-US Data Privacy Framework (DPF). New sub-processors are announced at least 30 days before engagement.
1. Sub-processors engaged by SalesLobe
These services are used for every customer.
Supabase, Inc.
- Purpose
- Database, file storage, authentication and serverless functions (core of the platform)
- Data
- All categories of workspace data, and saleslobe.com website analytics (page, referrer, UTM parameters, device/browser category, engagement, random session id and, with consent, a random visitor id, IP address (90 days) and the name of the network it belongs to)
- Location
- Database and file storage: EU, AWS eu-north-1 (Stockholm, Sweden)
- Transfer
- Storage in the EU; SCCs (Supabase DPA) for any access from outside the EEA
Supabase, Inc. (contact-form database, separate project)
- Purpose
- Contact-form submissions from saleslobe.com, separate from the platform database (website analytics moved to the EU platform database in October 2026)
- Data
- Contact-form submissions; website analytics recorded before October 2026 until it is deleted
- Location
- United States
- Transfer
- SCCs (Supabase DPA); planned move to the EU project after launch
Anthropic, PBC
- Purpose
- AI classification of replies, draft responses and follow-ups, AI assistant in the app
- Data
- Email content (subject, body, sender), prospect names and email addresses, tone guides and instructions
- Location
- United States
- Transfer
- SCCs (Anthropic Data Processing Addendum)
AhaSend
- Purpose
- Transactional email (login and account emails, lead notifications, reports), the BCC feedback loop for inbox management, and receiving email sent to SalesLobe addresses
- Data
- Recipient email addresses, email content (including the prospect's message and the suggested response in lead notifications)
- Location
- EU (EEA)
- Transfer
- Processing within the EEA
Vercel, Inc.
- Purpose
- Hosting of the web application (app.saleslobe.com) and client portals, including custom portal domains
- Data
- Technical access data (IP address, request data); customer data passes through in transit but is not stored
- Location
- Worldwide edge network
- Transfer
- SCCs; EU-US Data Privacy Framework where certified
Stripe Payments Europe, Ltd. / Stripe, Inc.
- Purpose
- Payments, subscription management and invoicing
- Data
- Name, email address, billing details, payment data (card data held solely by Stripe)
- Location
- EU / United States
- Transfer
- SCCs; EU-US Data Privacy Framework where certified
Functional Software, Inc. (Sentry)
- Purpose
- Error tracking of the web application
- Data
- Technical error data; email addresses are removed and no user data is attached before transmission
- Location
- EU, Sentry EU data region (Germany)
- Transfer
- Storage in the EU; SCCs / EU-US Data Privacy Framework for any access from outside the EEA
ipapi.is (Nikolai Tschacher)
- Purpose
- IP lookup: which organisation's network an IP address belongs to, for saleslobe.com visitors who accepted analytics; location and network of a new signup for our abuse check
- Data
- IP address (no other data is sent)
- Location
- Germany
- Transfer
- None (EU)
FutureMarketingAI
- Purpose
- Measuring whether a visit through a link in an Instagram message leads to a request (script on the contact page only, loaded only when the link carries an ?fmc= code)
- Data
- The link code (?fmc=), whether the contact form was sent, the website origin and technical request data (IP address, browser). Nothing is stored on the visitor's device and no form fields are read. Linked to the follower's Instagram id, which is erased automatically after 90 days; backups are kept 7 days. The IP address is only processed by their hosting provider (Vercel runtime logs, 30 days)
- Location
- EU, Frankfurt, Germany (Supabase eu-central-1, Vercel fra1)
- Transfer
- Processing within the EU. Their sub-processors: Vercel Inc. (United States, SCCs; sees the IP address, runtime logs kept 30 days) and Supabase (Frankfurt). Meta is a separate controller, not a sub-processor
Cloudflare, Inc. (Turnstile)
- Purpose
- Bot protection on sign-up, login and password reset
- Data
- IP address and browser signals of the person completing the check
- Location
- Worldwide network
- Transfer
- SCCs; EU-US Data Privacy Framework where certified
2. Services you connect yourself (optional)
These are only used when you connect them with your own account or API key. You engage them yourself under your own agreement with the vendor, so they are not sub-processors of SalesLobe (DPA, Article 7.4). SalesLobe exchanges data with them only on your instruction. They are listed so you have a complete picture of the data flows.
Smartlead
- When used
- Cold outreach, when you connect a Smartlead account
- Data
- Replies, lead and campaign data are read; approved responses are sent through Smartlead. After an erasure request, the lead is put on Smartlead's global block list and unsubscribed
- Location
- Per your agreement with Smartlead
- Basis
- Your own agreement with the vendor
Instantly
- When used
- Cold outreach, when you connect an Instantly workspace
- Data
- Replies, lead and campaign data are read; approved responses are sent through Instantly
- Location
- Per your agreement with Instantly
- Basis
- Your own agreement with the vendor
Make.com (Celonis)
- When used
- Your own Make.com scenario that forwards incoming email (Outlook/Gmail) to SalesLobe for inbox management
- Data
- Incoming email content and sender data; draft responses are returned to the scenario
- Location
- Per your agreement with Make.com
- Basis
- Your own agreement with the vendor
Calendly
- When used
- Meeting tracking, when you connect a Calendly account per client
- Data
- Booked and cancelled meetings (invitee name, email address, time), via a webhook registered with your token
- Location
- Per your agreement with Calendly
- Basis
- Your own agreement with the vendor
Cal.com
- When used
- Meeting tracking, when you add a SalesLobe webhook in Cal.com per client
- Data
- Booked, cancelled and rescheduled meetings (attendee name, email address, time)
- Location
- Per your agreement with Cal.com
- Basis
- Your own agreement with the vendor
Tymeslot
- When used
- Meeting tracking, when you add a SalesLobe webhook in Tymeslot per client
- Data
- Booked, cancelled and rescheduled meetings (attendee name, email address, time)
- Location
- Per your agreement with Tymeslot
- Basis
- Your own agreement with the vendor
Google (sign-in)
- When used
- Authentication, when a user chooses "Sign in with Google"
- Data
- Name and email address of the user
- Location
- Per Google's terms
- Basis
- Google's own terms
Your own Anthropic key (BYOK)
- When used
- AI requests of your workspace, when you enter your own Anthropic API key
- Data
- The same AI request data as above, under your own agreement with Anthropic
- Location
- United States
- Basis
- Your own agreement with Anthropic
Your webhooks and API integrations
- When used
- Outgoing webhooks, or your own AI agent or CRM connected via the SalesLobe API
- Data
- Reply and lead data sent to the endpoints you configure
- Location
- Wherever your endpoints run
- Basis
- Your responsibility as controller
3. Not engaged
- Other AI providers (such as OpenAI, Google Gemini or xAI): no data is sent to them. SalesLobe's AI router only allows Anthropic. Any future engagement happens only after contractual safeguards are in place and after announcement via the change procedure.
- Browser push services (for example Google, Apple, Mozilla) deliver the push notifications you switch on. Their content is end-to-end encrypted (Web Push); the push service only sees the encrypted message and the device address.
4. Questions
A Data Processing Agreement is available on request. Questions about this list: info@saleslobe.com
SalesLobe is a product of Den Hartogh Solutions · KVK 93891237 · Velp, the Netherlands · Privacy Policy · Terms · Security