Sub-processors & Connected Service Providers
Last updated: 24 September 2026 · Version 3.0
This page explains the third parties that may receive or process personal data when PeersUp OÜ provides the PeersUp service. Providers do not all have the same legal role. Some act as processors on our instructions, while connected platforms may act as independent controllers or under service-specific data processing terms.
Optional integration providers receive data only when the relevant feature is enabled or a user connects the corresponding account. PeersUp does not treat the existence of an integration as permission to use connected-service data for unrelated purposes.
Where processing involves a restricted transfer outside the EEA, we rely on the transfer mechanism applicable to the provider and service, such as an adequacy decision, the EU Standard Contractual Clauses, the EU-US Data Privacy Framework where valid and applicable, or another lawful safeguard.
Core infrastructure and service providers
| Provider | Role | Purpose | Data involved | Location | Privacy |
|---|---|---|---|---|---|
| Supabase | Processor | Database, authentication, file storage and backend infrastructure | Account, profile, CRM, content, configuration and application data | Primary project region selected in the EU (Frankfurt); provider support and subprocessors may operate in other regions | View |
| Cloudflare | Processor / infrastructure provider | CDN, DNS, edge delivery, security, DDoS protection and API routing | IP addresses, request metadata, security logs and content transmitted through the service | Global network | View |
| Resend (Plus Five Five, Inc.) | Processor | Transactional and service email delivery | Recipient email addresses, message content and delivery metadata | United States / global subprocessors | View |
| Stripe | Processor and/or independent controller, depending on the payment activity | Payments, subscriptions, invoicing, fraud prevention and payment compliance | Customer, billing, payment and transaction information | Global, including EU and United States | View |
| OneSignal | Processor | Push notifications and device delivery | Device/subscription identifiers, notification metadata and delivery information | United States / global subprocessors | View |
| Lovable Labs AB | Processor / service provider where used | Application infrastructure, AI gateway and connector routing used by selected PeersUp features | Service requests, technical logs and feature-specific data routed through enabled services | Sweden / provider subprocessors | View |
Optional communication and connected-platform providers
These providers are involved only when the corresponding integration is used. The permissions and data access requested by PeersUp are described in our Privacy Policy and in the provider's own consent screen.
| Provider | Role | Purpose | Data involved | Location | Privacy |
|---|---|---|---|---|---|
| Connected platform / independent service provider | Google OAuth, Gmail API and Google Calendar API when a user connects those services | Google account identity, authorized Gmail data, Calendar event data and OAuth tokens | Global | View | |
| Microsoft | Connected platform / independent service provider | Microsoft OAuth and Microsoft Graph for Outlook messaging | Microsoft account identity, authorized Outlook messages and OAuth tokens | Global | View |
| Meta Platforms Ireland Limited | Connected platform; processor or independent controller depending on the Meta service and applicable terms | Instagram API and WhatsApp Business Platform, including Meta-hosted WhatsApp Embedded Signup | Connected business-account identifiers, messages, comments, phone/WABA identifiers and OAuth/business tokens | European Union / global Meta infrastructure | View |
| Unipile SAS | Processor for connected-account API data | LinkedIn account connection, messaging and conversation synchronization | Connected LinkedIn account identifiers, conversation/message content and recipient identifiers | France / EU and documented subprocessors | View |
| LinkupAPI SAS | Integration service provider where enabled | Optional WhatsApp realtime/QR connection and messaging transport | Connection/account identifiers, phone number and API request/message data needed to provide the connection | France / provider infrastructure | View |
| User-selected SMTP/IMAP provider | Independent service selected by the user | Custom email sending and reply synchronization | Mailbox credentials, addresses and message data as required by the selected mail provider | Depends on the provider selected by the user | View |
AI and professional-research APIs
These services are feature-specific. Google Workspace API-derived Gmail data is excluded from PeersUp AI and enrichment workflows.
| Provider | Role | Purpose | Data involved | Location | Privacy |
|---|---|---|---|---|---|
| Perplexity AI | API service provider where the research feature is used | Public-web research and enrichment | Research queries and professional/public-source context submitted by the feature | United States / provider infrastructure | View |
| Exa Labs | API service provider where the research feature is used | Public web search for contact and company research | Search queries and public professional/company context | United States / provider infrastructure | View |
| Apollo.io (ZenLeads, Inc.) | Data/API provider where the validation feature is used | Professional contact and company data validation/enrichment | Name, company, company domain and professional identifiers used for matching | United States / provider infrastructure | View |
| Google Gemini | AI model provider where enabled through the PeersUp AI gateway | Selected AI-assisted planning, classification and drafting features | Feature prompts and context supplied to the selected AI workflow | Global | View |
User-directed AI assistants
If a user separately connects an external AI assistant such as ChatGPT to PeersUp, data requested through that authorized connection is disclosed at the user's direction to the assistant provider. The assistant provider is not a PeersUp sub-processor merely because the user chose to connect it; its own terms and privacy policy apply to its independent processing.
Changes and questions
This list is updated when material service providers or processing roles change. Where PeersUp has a contractual obligation to give advance notice of a new sub-processor, we will provide that notice in accordance with the applicable customer agreement or data processing terms.
Questions about a provider or transfer mechanism can be sent to privacy@peersup.com.