Sub-processors
External service providers who process personal data on Heqtic's behalf (GDPR Art. 28). When we add or change a sub-processor, we notify customers at least 14 days in advance. When one of our sub-processors in turn changes its own sub-processor, we pass on the notice as soon as we receive it — some sub-processors (today, FullEnrich) give us only 8 days' notice, and we cannot promise more advance notice than we ourselves get. This applies to changes and additions within the categories of processing already disclosed here — if the addition constitutes a new category of processing, the customer agreement § 12 applies instead: 30 days' notice and a right to terminate the agreement.
The customer may object to a new sub-processor within the notice period. We cannot promise to refrain — a vendor may be necessary for the service to work at all — but if we proceed anyway, the customer has the right to terminate the agreement as of the day the sub-processor is put into use, regardless of the commitment period and at no cost beyond what has already been delivered (customer agreement § 7).
Last updated:
| Vendor | Purpose | Region | DPA |
|---|---|---|---|
| Supabase | Auth, database (PostgreSQL), file storage | EU (Frankfurt) | Agreement |
| Vercel | App hosting and edge network | EU (Stockholm) for server execution since 2026-08-17; global edge delivery | Agreement |
| Anthropic (Claude) | Large language model for research and RBS generation | USA (SCC, EU-module based) | Agreement |
| Resend | Email delivery, three distinct purposes. (1) Transactional account email — login links to the customer's account. (2) Outbound contact email to prospective customers (Heqtic's own lead generation). (3) Notification channel (optional, off by default) — sends a separate email to the customer's own account owner per approved RBS (if several RBSes are approved in the same batch, one email each, not a combined email). Each email contains the company name concerned, a link to the deliverable, and a download link to that specific RBS as a PDF — the same kind of link, on the same terms, as the corresponding link in the Slack notification below: no fixed expiry, but guaranteed to stop working no later than when the RBS is withdrawn, when we have entered an objection or deletion request into the suppression list, or when the contact details age out of the material. | EU | Agreement |
| FullEnrich | Contact enrichment — verified email and phone number for decision-makers | USA. The vendor is established in the US — the appendix to the standard contractual clauses names the importer at a San Francisco address. The transfer is protected by the European Commission's standard contractual clauses, module 2 (and module 3 for the vendor's own onward transfers). FullEnrich has no contractual term on where data is stored. Per the vendor's current list of its own sub-processors (August 2026), hosting is at DigitalOcean (a US company, storage in the EU), the vendor handling phone numbers is in the EU, and two vendors for email-address verification are in the US. The list can change with 8 days' notice, and the data in any case passes through the vendor's own US infrastructure — the storage location is therefore no guarantee; the protection lies in the standard contractual clauses. | AgreementData processing agreement under the vendor's standard terms (version 2 August 2026) — the standard contractual clauses are at fullenrich.com/standard-contractual-clauses |
| Cal.com, Inc. (cal.eu) | Meeting booking — name, email, and meeting details for meeting participants, plus technical data (IP address, device and log data). We use the EU instance cal.eu, not the US cal.com instance. | Storage and processing in the EU (Frankfurt) under the data processing agreement's §11.3. The vendor is, however, a US company, and access from countries outside the EU/EEA may occur for support, security, incident handling, and operational continuity — the transfer therefore relies on the European Commission's standard contractual clauses (module 2). | Signed data processing agreement (2026-08-03) — copy on request |
| Unipile | Optional mailbox integration (activated only if the customer connects their own Gmail/Outlook): Unipile mediates the OAuth connection and signals when the customer has sent an email or received a reply, so the correct RBS can be updated automatically. We store no email text — only the sender/recipient address, timestamp, and a locally derived classification of the reply (e.g. out-of-office/unsubscribe) for matching. Unipile can also (prepared but not yet activated) mediate retrieval of public LinkedIn profile and activity data (role, recent posts) for prospect research, and profile identifiers/message content for our own lead generation. | Not in use. Both features have been off since 12 August 2026 and we send no personal data to Unipile. The vendor states it is based in the EU (France) per its own information — not verified against the agreement, and we do not verify it until the service is actually put into use. A data processing agreement is a precondition for turning the features back on. | Not in use — no data processing agreement needed as long as the feature is off |
| Wint Accounting AB | Bookkeeping service — ongoing bookkeeping, invoices, receipts, and accounting records under the Swedish Accounting Act (see "Invoicing & bookkeeping" below). | The platform (including databases) is hosted in the EU/EEA (Microsoft Azure, Ireland). Wint in turn engages its own sub-processors for parts of the service — 15 of 19 in Sweden/EU/EEA. Four are entirely outside the EU/EEA: Anthropic PBC (USA, interpretation of uploaded bookkeeping material), Creative Technology Solutions (Pvt) Ltd (Sri Lanka, outsourced bookkeeping of receipts and supplier invoices — Sri Lanka is not covered by any EU adequacy decision), and Calendly and Sendgrid (USA, meeting booking and transactional email respectively). Under Wint's data processing agreement §12, each such transfer is premised on either an adequacy decision or the European Commission's standard contractual clauses — we have not verified per sub-processor which basis applies. | Signed data processing agreement, appendix to the engagement agreement (2026-08-28) — copy on request |
| Slack | Two distinct purposes. (1) Notification channel (optional) — sends a notification to the customer's own Slack channel when new RBSes are ready, or when a person in a delivered RBS has requested deletion or objected (customer agreement § 5). Contains RBS metadata (company name, RBS ID) and a link to the deliverable. If the notification concerns a single RBS, a download link to the RBS as a PDF is also attached — no fixed expiry, but guaranteed to stop working no later than when the RBS is withdrawn, when we have entered an objection or deletion request into the suppression list, or when the contact details age out of the material. It contains the entire material including contact details, and can be opened by anyone with access to the channel without logging in to Heqtic, for as long as the link remains valid. Link preview is disabled so Slack does not fetch the content. (2) Heqtic's own operational alerting to our own Slack channel, which we ourselves initiate: technical errors and anomalies, with column names, error causes, and internal record IDs (e.g. user ID and RBS ID) — no names, email addresses, or company registration numbers. Internal IDs are still personal data when we can link them to a person, and are therefore disclosed here. | USA (DPF + SCC); purpose (1) is activated only if the customer connects a webhook themselves | Agreement |
| Upstash, Inc. (QStash) | Message queue that chains RBS generation across multiple steps to avoid the platform's runtime limit. Each step sends only an internal submission ID (a UUID) through the queue — never company names, contact details, or any other RBS content. Each step reads all content back directly from our database itself. | EU (AWS eu-central-1) per the account's own region setting, verified in the Upstash console. | No separate data processing agreement — assessed as sufficient given that only an internal ID passes through the queue and the account is EU-based. |
CRM integration — the customer's own system
The full description of what is transferred and which settings exist is on the integrations page. This section explains why the integration is not a sub-processor.
The customer may connect its own CRM (HubSpot, Pipedrive, Salesforce, Lime CRM, or Upsales, one at a time) to forward an individual RBS into its own sales process. This is not a sub-processor of Heqtic and therefore does not appear in the table above: the customer connects its own account with its own API token that the customer itself issues, and already has its own data processing agreement with its CRM provider. Heqtic has no account and no agreement with the provider, and has no general access to the content of the customer's CRM — what we read is strictly limited to the two cases described below.
The integration is optional and inactive until the customer connects a token itself. Data leaves Heqtic only once the customer sends an individual RBS there — either manually or, if the customer has turned on automatic push, when the customer marks an RBS as contacted. What is transferred is the company name and contact details (name, title, email, phone number, LinkedIn) plus the buying signal. A push only creates or updates records Heqtic has itself created — an existing record in the customer's CRM is linked to, but never overwritten.
What Heqtic reads in the customer's CRM. Two limited cases, and no others:
- Duplicate check (Pipedrive only, on push). Before a record is created, we search for an existing organisation (by company name) and person (by email) to avoid creating duplicates. Only the matched record's ID is stored.
- Deal outcome (optional, off by default). If the customer turns this on, we read once per day whether deals Heqtic itself has created have been marked won or lost, and update the status on the corresponding RBS. If the customer has, for Pipedrive, also chosen which of its own pipeline stages means "Contacted", we simultaneously check whether the deal is in that stage and mark the RBS as contacted. We only retrieve this outcome value — and for Pipedrive, where applicable, which of the two stages the customer has chosen the deal is in — no contacts, notes, activities, email, or other fields — and we never read deals the customer has created itself. A status the customer has set manually is never overwritten.
Once the data has been transferred to the customer's CRM, the customer is an independent controller for the processing there — Heqtic's deletion of a prospect record on our side does not reach into the customer's CRM; the customer is responsible for the corresponding deletion there, including in notes and free text. HubSpot is hosted in the US (DPF + SCC, EU data hosting optional); Pipedrive is EU-based (Estonia), but the customer may have chosen a US region for its account — which region applies is determined by the customer's own account. See the integrations page for Salesforce, Lime CRM, and Upsales regions and vendor terms.
Transfer to a third country
Anthropic (Claude) is hosted in the US. The transfer takes place under the European Commission's Standard Contractual Clauses (SCC, decision 2021/914) with supplementary safeguards. No special category of personal data (GDPR Art. 9) is sent to the Claude API.
Cal (meeting booking) stores and processes booking data in the EU (Frankfurt) under the data processing agreement's §11.3, but the vendor Cal.com, Inc. is American and access from outside the EU/EEA may occur for support, security, incident handling, and operational continuity. The transfer therefore takes place under the standard contractual clauses (module 2), with EU storage as a supplementary safeguard.
Slack (optional notification channel) is hosted in the US. The transfer relies on the EU-US Data Privacy Framework (Slack belongs to Salesforce, which is DPF-certified) with SCC as a complement, and is activated only if the customer connects a webhook themselves. We otherwise choose EU-based vendors when an equivalent alternative exists.
The customer's own CRM integration is addressed separately above — that transfer goes to the customer's own system and under the customer's own agreement with the CRM provider.
Wint Accounting AB (our bookkeeping service) hosts the platform itself in the EU/EEA, but engages four sub-processors outside the EU/EEA for parts of the service — see the table above for which ones and for what purpose. Invoicing details (the customer's company name, contact details, and amounts), and in some cases personal identity numbers and bank account numbers, may thereby reach the US and Sri Lanka. No prospect or RBS data goes to Wint — only Heqtic's own invoicing details.
Invoicing & bookkeeping
The invoicing details you provide when ordering are stored in our database (Supabase, see above). Our bookkeeping is handled by Wint Accounting AB (see the table above), which stores the invoice as accounting records under the Swedish Accounting Act (7 years).
Source code storage (GitHub)
The product's source code is stored at GitHub (Microsoft), USA. GitHub should not contain personal data — the repository is private, environment variables and keys are excluded from version control, and an automatic check blocks commits that would attach a deliverable. GitHub is therefore not treated as a sub-processor and does not appear in the table above, on the same basis as the CRM integration: it is development infrastructure, not a service that processes prospect data on our behalf. We nevertheless have a data processing agreement with GitHub in place (the GitHub Data Protection Agreement, SCC modules 1–3) as a safeguard, since three PDF files containing prospect data were accidentally present in the repository's history for a period in 2026, before they were discovered and removed.
What we do not use
We use no analytics, ad-tech, or social-tracking tools. No third-party cookies are set.