Contents
What a subprocessor is
A subprocessor is a third-party provider that may process data on behalf of SynchrotronAI so SynchrotronAI can operate the website, provide products, deliver professional services, run managed services, host systems, secure infrastructure, process payments, receive intake forms, and support customers.
The exact provider set can vary by product, project, customer-selected cloud, integration, pilot, managed services scope, and signed agreement. A customer order may identify additional or narrower providers for a specific engagement.
Core providers
| Provider | Purpose | General data categories | Location |
|---|---|---|---|
| Amazon Web Services, Inc. | Cloud hosting, compute, PostgreSQL databases, document storage, encryption keys, queues, logging, monitoring, backups, transactional email through Amazon SES, and AWS Marketplace purchase fulfillment for all products. | Application data, account and contact details, uploaded documents, email addresses and transactional email content, technical logs, operational metadata, and marketplace customer and agreement identifiers. | United States and selected AWS regions. |
| Cloudflare, Inc. | DNS, CDN, edge security, traffic routing, caching, bot protection, website reliability, and consent-managed website measurement through Cloudflare Zaraz. | IP addresses, request metadata, security logs, cache metadata, browser details, and website interaction events. | United States and Cloudflare global edge network. |
| Stripe, Inc. | Payment processing, checkout, subscriptions, invoices, tax calculation, customer billing portal, fraud prevention, and financial operations. | Billing contact information, business name, billing address, tax identifiers, payment details submitted to Stripe, transaction metadata, and payment support records. | United States and other locations used by Stripe. |
| HubSpot, Inc. | Website intake forms, CRM records, sales communication, workflow review requests, and business follow-up. | Contact details, company information, inquiry context, form submissions, communication records, and CRM metadata. | United States and other locations used by HubSpot. |
| Twilio Inc. | ScamFreeLife phone number verification, protected phone numbers, call screening and forwarding, speech transcription when the AI call assistant is unavailable, inbound SMS and MMS, and trusted-contact alerts. | Phone numbers, caller ID, call audio streamed in real time (not recorded), call metadata, SMS and MMS content, verification codes, and trusted-contact phone numbers. | United States and other locations used by Twilio. |
| OpenAI, L.L.C. | AI processing for ScamFreeLife scam assessments, message transcription, and real-time call screening, and for Tariff Agent and Capital Agent research and workflow assistance. | Message, email, and call content, call audio and transcripts, URLs, communication metadata, and workflow inputs needed to provide the requested analysis. Response storage is disabled, and OpenAI may not use this data to train its models. | United States and other locations used by OpenAI under the applicable service terms. |
| Google LLC | Sign in with Google, ScamFreeLife Gmail connections and Gmail change notifications, Android push notifications, Google Play purchases and subscription notifications, and YouTube video embeds on the website. | Name, email address, account identifiers, sign-in tokens, message content and metadata from connected Gmail accounts, device push tokens, purchase and subscription records, and browser details for embedded video. | United States and other locations used by Google. |
| Microsoft Corporation | Sign in with Microsoft (Microsoft Entra ID) and ScamFreeLife Outlook connections through Microsoft Graph, including change notifications. | Name, email address, account and tenant identifiers, sign-in tokens, and message content and metadata from connected Outlook accounts. | United States and other locations used by Microsoft. |
| Apple Inc. | Sign in with Apple, App Store purchases and subscription notifications, Apple push notifications, iOS app distribution, and, where enabled, SMS message filtering for ScamFreeLife. | Apple account identifiers and relay email addresses, purchase and subscription records, device push tokens, and, where SMS filtering is enabled, the sender and text of filtered messages. | United States and other locations used by Apple. |
| GitHub, Inc. | Source control, development workflow, issue management, deployment automation, code review, and engineering operations. | Code, issue metadata, deployment metadata, operational records, technical context, and limited business information needed for delivery. | United States and other locations used by GitHub. |
Some features that use these providers, such as push notifications, native call delivery, SMS filtering, and trusted-contact text messages, are enabled only when the relevant product feature is turned on for your account or region.
Provider notice fields
For each provider, SynchrotronAI tracks the provider name, purpose, applicable product or function, general data categories, expected processing location, and whether the provider is generally used or project-specific. Customer-specific provider details may be documented in an order, security questionnaire, architecture document, or DPA exhibit.
Project-specific providers
Some engagements may require customer-selected cloud platforms such as Microsoft Azure or Google Cloud, identity providers, CRMs, ERPs, data warehouses, analytics systems, cloud accounts, monitoring tools, email providers, ticketing systems, AI model providers, storage services, or other integration partners. Those providers should be identified in the applicable statement of work, architecture, order, security documentation, or customer instructions when they materially process customer data.
Provider diligence
SynchrotronAI considers provider purpose, security, reliability, availability, data categories, processing location, contractual terms, and fit for the engagement. Provider review may vary based on risk, data sensitivity, customer requirements, project scope, and whether the provider is selected by SynchrotronAI or directed by the customer.
Changes and objections
SynchrotronAI may update this list as vendors, cloud architecture, products, services, and managed support evolve. SynchrotronAI will update this page at least 15 days before a new subprocessor begins processing customer personal data and will notify business customers who have asked for notices through the contact form. If a subprocessor must be added or replaced urgently, for example to restore or maintain the services or to address a security risk, SynchrotronAI may engage it before that period ends and will update this page and notify those customers as soon as practicable. Customers covered by the Data Processing Agreement may object to a new subprocessor on reasonable data protection grounds as described there.
Customer responsibilities
Customers are responsible for identifying customer-directed providers, approving architecture choices, configuring customer-controlled systems, managing access, and ensuring that data provided to SynchrotronAI is appropriate for the selected providers and regions.
Contact
Questions about subprocessors may be submitted through the contact form.