Sub-processors
A sub-processor is any third party we use that receives or processes customer data on our behalf. This page lists every one currently in use, in the same detail our Data Processing Agreement §5 commits to contractually — if the two ever disagree, the DPA is the operative document and this page is the one that's wrong.
1. Current sub-processors
| Name | Purpose | Data categories | Location | Date added |
|---|---|---|---|---|
| Hetzner Online GmbH | Application and database hosting. | All customer and account data, at rest. | Germany / Finland | At launch (May 2026) |
| Cloudflare, Inc. | DDoS protection, CDN, and R2 object storage for uploaded avatars and logos. | Network traffic metadata; uploaded avatar/logo files. | US, with EU data localisation where applicable | At launch (May 2026); R2 object storage added 28 June 2026 |
| Stripe Payments Europe, Ltd. | Billing and payment processing. | Billing name, address, and payment method (Stripe holds card details; Warmerly does not). | Ireland, with US parent | At launch (May 2026) |
| Resend, Inc. | Transactional and broadcast email delivery for Warmerly's own service notifications. | Recipient email address, name, and message content of service/marketing mail Warmerly sends. | United States | 24 June 2026 |
| Unipile SAS | LinkedIn and WhatsApp account connection and message sync. | Connection credentials, and messages/contacts on connected LinkedIn/WhatsApp accounts. | France | 23 June 2026 |
| Meta Platforms, Inc. | Instagram account connection and messaging, where a customer connects an Instagram account. | Connection credentials, and messages/contacts on the connected Instagram account. | United States | 2 July 2026 |
| OpenRouter, Inc. | Routing of AI requests to model providers for inbox classification, reply drafting, campaign personalisation, and the support assistant. | Message extracts, campaign context, and business-contact information submitted for AI processing. | United States | 5 July 2026 |
| Google LLC / Google Ireland Ltd. | Gemini models for the AI features above, and Google Analytics 4 on our marketing site (consent-gated). | Same AI processing data as above where Gemini is the active model; page-view and conversion analytics for GA4. | United States / Ireland | Gemini routing added 17 August 2026; GA4 added 16 August 2026 |
| Whop, Inc. | Conversion measurement on our marketing site (consent-gated). | Page views and sign-up conversions on the marketing site. No customer/account data. | United States | 16 August 2026 |
| Webshare Software Company | Proxy infrastructure used by our lead-database crawling and verification workers. | None — no customer content passes through it; it proxies outbound requests to public web sources. | United States | 30 June 2026 |
Dates before roughly June 2026 are recorded as "at launch" rather than a specific day — that is a limit of when we started tracking this precisely, not an attempt to understate how long a relationship has existed.
2. Advance notice before a new sub-processor
Before we start using a new sub-processor to process customer data, we will give at least 30 days' notice — by updating this page and, for customers who have subscribed (see section 4), by email. The 30-day window is the same commitment already made in DPA §5.
3. Objecting to a new sub-processor
If you object to a new sub-processor on reasonable data-protection grounds, email privacy@warmerly.com within the notice window and tell us why. We will work with you to find an alternative; if we can't resolve it, you may terminate the affected part of the service without penalty, per DPA §5.
4. Subscribe to changes
We don't currently run a self-serve mailing list for this page. To be notified by email whenever a sub-processor is added, removed, or changed, send a short note to privacy@warmerly.com with the subject "Subscribe: sub-processor changes" and we will add your address to the notice list by hand. You can unsubscribe from that list at any time the same way.
5. Related documents
See our Data Processing Agreement for the contractual sub-processor commitment, our Privacy Policy for how we use data generally, and our Trust and Security page for an overview of our infrastructure and security posture.
6. Contact
Kristiyan Tsvetanov, trading as Warmerly, 318 Shady Lane, Birmingham, B44 9EB, England, United Kingdom. Email privacy@warmerly.com for questions about this list.