Sub-processors

These companies process personal data for Lead Magnet Oy when we provide our apps and services to our clients. Each one is bound by a written agreement that protects the data at least as well as our own data processing agreement (DPA) with our clients.

Changes. We tell our clients by email at least 14 days before we add or replace a sub-processor, and a client can object (DPA §4). This page shows the date of its current version.

Where your data is. We keep data in the EU. The exceptions are marked outside the EU below, and our privacy policy lists them too (https://leadm.app/privacy, section 8).

1.Used for every client

Company	What for	Personal data it handles	Location	Safeguards
Hetzner Online GmbH	servers, databases, file storage (Object Storage) and backups for every app	everything we store	servers and file storage in Helsinki, Finland; backups in Falkenstein, Germany (nightly encrypted backups kept 57 days, hourly database copies kept 2 days)	EU
Ploi B.V.	server management and deployments	access to the servers it manages, and so to the data on them	Netherlands	EU
OVHcloud SAS	AI models, through our own AI gateway (LeadLLM)	what users type into AI features and the content the AI works on: LeadChat's assistant, translation and writing help (a business's conversations, only when it has turned AI on); LeadStudio's edits (email addresses, phone numbers, identity codes, bank account numbers and recorded names replaced with placeholders first); LeadCore's report summaries (statistics and page-level figures, no contact details), proposal drafts (a prospect's message and website text) and staff assistant; LeadSEO's analysis (site content, Search Console figures, up to 50 searches)	France	EU. No retention of submitted data and no training, as our DPA annexes state
Zoho Corporation B.V. (ZeptoMail)	sending email: every app's mail through LeadMail, and MagnetID's sign-in emails	recipients, sender, subject, content and attachments, including lead contents and LeadChat replies	Zoho's EU data centres	EU
Cobisi Research S.r.l. (Verifalia)	checking that email addresses exist, through LeadMail	email addresses (LeadMail tells Verifalia to delete each check after 60 minutes; replies to people who wrote first are never checked)	Italy; data stored in Germany	EU
Google LLC (Firebase Cloud Messaging)	push notifications to phones in the Lead Magnet app	the device's push token and the notification text: with previews off (the default) the company and what happened; with previews on, a customer's first name and the start of a message	outside the EU: USA	EU–US Data Privacy Framework and standard contractual clauses
Apple Inc. (Apple Push Notification service)	push notifications to iPhones in the Lead Magnet app, through Firebase	the device's push token and the notification text	outside the EU: USA	standard contractual clauses

2.Used for specific services

Company	Service	What for	Personal data it handles	Location	Safeguards
Anthropic PBC	LeadStudio	AI for design and structure when we build a demo website for a prospect	the prospect's public website content only; no data from our apps	outside the EU: USA	standard contractual clauses
Google Ireland Ltd (Search Console)	LeadSEO	reading the search data a client agrees to share	the Google connection (refresh token) and search performance figures, including the searches	Ireland, with transfers to Google LLC (USA)	EU–US Data Privacy Framework
DataForSEO OÜ	LeadSEO	search volumes, Google Ads keyword ideas, rankings and backlinks	website addresses and keywords, including searches from Search Console that the AI judged to be keywords for the business (at most 10 per site), which can contain a name	Estonia; servers in Germany; some of its own providers outside the EU (USA, United Kingdom)	EU; standard contractual clauses or adequacy decisions for its providers outside the EU

Per-client extras. When we set up an extra LeadChat channel or integration for one client through Lead Magnet's own account, app or key, that company is listed on the client's own privacy page in LeadCore, with the client's recorded acceptance. It is not listed here.

Claude models (Anthropic) are used only for website demos built from a prospect's public website (section 2). Under our EU data residency rule they never receive personal data from our apps, and our clients' AI keys can't call them.