Sub-processors
Every third party we send personal data to, what each one receives, and where it sits. This list forms part of the Privacy Policy and the Data Processing Agreement.
1How to read this
A sub-processor is a company we use to run LinkScout that handles personal data on our behalf. Providers marked receives prospect data also handle the personal data of the people you contact - the data for which you are the controller and we are your processor. The rest only ever see your own account data.
Under the Data Processing Agreement you authorise the providers below. We will announce a new one here, and by email, at least 30 days before it starts handling data.
2Infrastructure
| Provider | What it does, and what it gets | Where |
|---|---|---|
| Vercel Inc.receives prospect data | Hosting and delivery of the website and application. Request metadata, IP address, anything submitted through the app in transit. | USA, with EU edge regions |
| Supabase Inc.receives prospect data | The database where everything is stored. All account data, prospect data, messages, drafts and links. | EU (Frankfurt) - verify the region of your project |
| Clerk Inc. | Sign-in, account identity and session management. Your name, email address, password credentials and session data. | USA |
3Billing and our own email
| Provider | What it does, and what it gets | Where |
|---|---|---|
| Stripe, Inc. / Stripe Payments Europe Ltd. | Payments and subscription billing. Your name, email address, billing address and payment details. | USA and Ireland |
| Resend (Plus Five Five, Inc.) | Transactional email from us to you - trial warnings, billing notices, alerts. Your email address and the content of those notifications. | USA |
4The outreach pipeline
These are the providers involved in finding, writing to and hearing back from the websites you target.
| Provider | What it does, and what it gets | Where |
|---|---|---|
| Serper (serper.dev) | Search results for the keywords and competitors you choose. The search phrase only - never an account, customer or website identifier. | USA |
| Hunter (Hunter Web Services, Inc.)receives prospect data | Finding a contact address at a website you targeted, when nothing cheaper worked. The target domain, and a person's name where one was found on the site. | USA and France |
| NeverBounce (ZoomInfo Technologies LLC)receives prospect data | Checking whether a contact address is deliverable before anything is sent to it. The email address being checked, and nothing else. | USA |
| Anthropic PBCreceives prospect data | Writing outreach, follow-ups and guest post drafts, classifying replies, and preparing editable reply drafts. The content of the target page, your site description, and the text of outreach and matched campaign replies. | USA |
| Google LLCreceives prospect data | Gmail access, where you connect a Gmail mailbox. Authorisation to send outreach and to check new Inbox message metadata, then read full content only for matched campaign replies. | USA and EU |
| Microsoft Corporationreceives prospect data | Outlook access, where you connect an Outlook mailbox. Authorisation to send and read mail in the mailbox you connected. | USA and EU |
Two things worth stating about this table. The search provider receives the search phrase and nothing else - no account identifier ever reaches it, which is also why the result cache can be shared safely. And content sent to the model provider is not used to train their models.
5Analytics
Neither of these sets advertising cookies or tracks visitors across other websites, which is why this site has no cookie banner.
| Provider | What it does, and what it gets | Where |
|---|---|---|
| Vercel Analytics | Page views and performance on our website. Page URL, referrer, coarse device and country data. No cookies, no cross-site tracking. | USA |
| DataFast | Website and AI crawler analytics. Page URL, referrer, user agent. No cookies, no cross-site tracking. | EU |
6Transfers outside Switzerland and the EEA
Several providers above are in the United States. Those transfers are covered by the European Commission’s Standard Contractual Clauses with the Swiss adaptations recognised by the Federal Data Protection and Information Commissioner, or by an adequacy decision where one applies, together with the additional technical and organisational measures required of us.
7Questions
Ask at support@linkscout.io - including if you want to object to a new sub-processor.