Sub-processors
Last updated November 8, 2026. Draft for legal review: not legal advice.
These are the companies Inboxed engages to process personal data for our customers, under our Data Processing Agreement. Some are used only when you turn a feature on.
| Company | What for | Data | Location | When |
|---|---|---|---|---|
| Hostinger International Ltd | Application hosting | All service data | To be confirmed (demo) | Always |
| Hostinger International Ltd | Database and backups | All service data | To be confirmed (demo) | Always |
| Resend | Account and security emails (codes, invites, alerts, reports) | Account email addresses and email content | United States | Always |
| Stripe | Wallet top-ups and invoices | Billing contact, payment details (held by Stripe), amounts | United States | When you add funds |
| Anthropic | AI drafts, reply classification and summaries with Inboxed’s key | Email text and lead fields the feature needs | United States | When AI features are on and you haven’t connected your own AI key |
| Sign in with Google; sending and reading campaign threads in Gmail mailboxes through Inboxed’s Google app | Account email, mailbox tokens, campaign emails and replies | United States | When you sign in with Google or connect a Gmail mailbox | |
| Microsoft | Sign in with Microsoft; sending and reading campaign threads in Outlook mailboxes through Inboxed’s Microsoft app | Account email, mailbox tokens, campaign emails and replies | United States / EU | When you sign in with Microsoft or connect an Outlook mailbox |
| Meta Platforms (WhatsApp Business) | Notifications to your team on WhatsApp | Team member phone numbers, notification text (may include a lead’s name) | United States | When a team member turns on WhatsApp notifications |
| Telegram | Notifications to your team on Telegram | Telegram chat id, notification text | United Arab Emirates / global | When a team member turns on Telegram notifications |
| Web push services (Google, Apple, Mozilla) | Browser notifications | Encrypted notification payloads | United States | When a team member turns on browser notifications |
| Name.com | Registering sending domains you buy through Inboxed | Registrant contact details | United States | When you buy a domain |
| Mailgun | Receiving DMARC aggregate reports | DMARC reports (sending IPs and domains, no recipient data) | United States / EU | When DMARC reporting is on |
Services you connect yourself
When you connect a service with your own account or API key, that provider is your own processor (your contract with them applies), not an Inboxed sub-processor:
- Your own mailboxes over SMTP/IMAP, Google Workspace or Microsoft 365
- AI providers you connect with your own API key (Anthropic, OpenAI, Google Gemini, Groq)
- Email verification and enrichment providers you connect (for example ZeroBounce, NeverBounce, MillionVerifier, Hunter, Apollo, People Data Labs)
- CRMs and apps you connect (for example HubSpot, Salesforce, Pipedrive, Close, Attio, Slack, Notion, Airtable, Google Sheets, Zapier, Make)
Hear about changes
We email subscribers at least 30 days before we add or replace a sub-processor. You confirm by email first, and every notice has a link to stop them.