Legal · Last updated 25 September 2026
Sub-processors
Contents
A sub-processor is any third party we use that receives or processes customer data on our behalf. This page lists every one currently in use, in the same detail our Data Processing Agreement §5 commits to contractually — if the two ever disagree, the DPA is the operative document and this page is the one that's wrong.
1. Current sub-processors
| Name | Purpose | Data categories | Location | Date added |
|---|---|---|---|---|
| OVH SAS | Servers for the application, the main database, and our hosted-mailbox mail servers (OneMail). | All customer and account data, at rest and in processing. | Germany (Frankfurt), United Kingdom (Erith) | At launch (May 2026) |
| Cloudflare, Inc. | DNS, DDoS protection and CDN; bot checks on sign-up and support forms; R2 object storage for uploaded images and files; registration and DNS for domains ordered through OneMail; status-page failover. | Network traffic metadata, including IP addresses; uploaded files; domain and DNS records for OneMail domains. | United States, with a global network | At launch (May 2026); R2 object storage added 28 June 2026; OneMail domains added 6 August 2026 |
| Microsoft Corporation / Microsoft Ireland Operations Ltd. | Primary AI provider for inbox classification, reply drafting, campaign personalisation and the support assistant (Azure OpenAI); storage of encrypted database backups (Azure Blob Storage). | Message extracts, campaign context and business-contact information submitted for AI processing; encrypted backups of the full database. | Sweden (AI, Sweden Central region); Germany (backups, Germany West Central region) | 23 September 2026 |
| OpenRouter, Inc. | Fallback routing of AI requests to model providers, used when the primary AI provider fails. Requests may go only to upstream providers that do not retain prompts. | Message extracts, campaign context, and business-contact information submitted for AI processing. | United States | 5 July 2026 |
| Google LLC / Google Ireland Ltd. | Gemini models reached through OpenRouter when it is used as the fallback; Google Analytics 4 on our website (consent-gated); delivery of push notifications to Android devices. | AI processing data as above, when a request falls back to a Gemini model; page-view and conversion analytics for GA4; push notification content (see Expo below). | United States / Ireland | GA4 added 16 August 2026; Gemini added 17 August 2026; push delivery added September 2026 |
| Backblaze, Inc. | Storage of message bodies and attachments for mailboxes we host (OneMail and the free mailbox). | Full content of mail sent from and received by hosted mailboxes. | United States company (treated as a US transfer under DPA §6) | 6 August 2026 |
| Stripe Payments Europe, Ltd. | Billing and payment processing. | Billing name, address, and payment method (Stripe holds card details; Warmerly does not). | Ireland, with US parent | At launch (May 2026) |
| Resend, Inc. | Delivery of Warmerly's own service, account and broadcast email, and receipt of mail sent to our support address. | Recipient email address, name, and message content of mail Warmerly sends; mail customers send to our support address. | United States | 24 June 2026 |
| Amazon Web Services EMEA SARL | Amazon SES: delivery of customer transactional email (password resets, receipts and notifications sent through the transactional email API) and its bounce/complaint event notifications. | Sender and recipient email addresses, names, and message content of transactional email sent through Warmerly. | Sweden (eu-north-1, Stockholm) | 25 September 2026 |
| Unipile SAS | LinkedIn account connection, messaging and sync. | Connection details, and messages and contacts on connected LinkedIn accounts. | France | 23 June 2026 |
| Meta Platforms, Inc. | Instagram account connection and messaging, where a customer connects an Instagram account. | Connection credentials, and messages/contacts on the connected Instagram account. | United States | 2 July 2026 |
| Zernio | Connection of social accounts, and scheduling and publishing of content to them, where a customer uses content scheduling. | Social account identifiers, post text and media, and publishing status. | Outside the UK/EEA (treated as a restricted transfer under DPA §6) | 1 August 2026 |
| 650 Industries, Inc. (Expo) | Delivery of push notifications to the Warmerly mobile app. | Device push token; the sender name or address, subject and a short preview of new inbound messages. | United States | September 2026 |
| PostHog, Inc. | Product analytics, error monitoring and session replay for the Warmerly app and site, so we can find and fix problems customers run into. | Account holders' user id, email, name and role (only after cookie consent); pages viewed, clicks, errors, session replays and technical details. | United States | 23 September 2026 |
Dates before roughly June 2026 are recorded as "at launch" rather than a specific day — that is a limit of when we started tracking this precisely, not an attempt to understate how long a relationship has existed. Where only a month is shown, we do not have a reliable record of the exact day.
Some services are not on this list because they are not our sub-processors. The providers of the mailboxes and platforms you choose to connect (for example Google Workspace, Microsoft 365, LinkedIn or WhatsApp) act under your own agreements with them, apart from those listed above. The same goes for the mail servers of the people you send to. We also run some services ourselves on the servers listed above, including our mail servers and the search service behind the email finder. The private network we use for administrative access (Tailscale) carries only encrypted traffic between our own servers.
2. Advance notice before a new sub-processor
Before we start using a new sub-processor to process customer data, we will give at least 15 days' notice — by updating this page and, for customers who have subscribed (see section 4), by email. The 15-day window is the same commitment made in DPA §5. The one exception, also in DPA §5, is an urgent replacement needed to keep the service secure or running. In that case we give notice as soon as we reasonably can, and you can still object.
3. Objecting to a new sub-processor
If you object to a new sub-processor on reasonable data-protection grounds, email privacy@warmerly.com within the notice window and tell us why. We will discuss it with you in good faith; if we can't resolve it, you may terminate the affected part of the service, per DPA §5.
4. Subscribe to changes
We don't currently run a self-serve mailing list for this page. To be notified by email whenever a sub-processor is added, removed, or changed, send a short note to privacy@warmerly.com with the subject "Subscribe: sub-processor changes" and we will add your address to the notice list by hand. You can unsubscribe from that list at any time the same way.
5. Related documents
See our Data Processing Agreement for the contractual sub-processor commitment, our Privacy Policy for how we use data generally, and our Trust and Security page for an overview of our infrastructure and security posture.
6. Contact
Warmerly. Email privacy@warmerly.com for questions about this list.