Legal
Sub-processors
Last updated 28 September 2026
In plain English
A sub-processor is a company that handles personal data for us, so we can run the service. These are all of them: what each does, where it happens, and the legal safeguard for data leaving the UK. We tell customers 30 days before we add one.
Why this page exists
When you email creators through RecruitAffiliates.ai, you're the controller of that data and we're your processor. The law says we can't pass it to anyone else without your say-so. Accepting our terms, which include the data processing agreement, authorises the companies below. This list is Annex 3 of that agreement.
The same companies also handle the data we control ourselves: your account, and the public creator data our scans gather. The privacy policy says which is which.
Telling you about changes
We give 30 days' notice before a new sub-processor starts on your data. It goes to the email on your account, and this page changes the same day. If you object, tell us within those 30 days. We'll find another way, or you can end your subscription and we refund the unused part.
To hear about changes, email support@recruitaffiliates.ai with "sub-processor notices" in the subject.
The list
Checked against what the software calls, not against a brochure. Where a safeguard isn't confirmed yet, the row says so.
| Who | What they do for us | Where | Transfer safeguard |
|---|---|---|---|
| Vercel (Vercel Inc.) | Hosting for this site and the app, and file uploads. Request logs include IP address and browser. | United States, iad1 | 2021 Standard Contractual Clauses with the UK International Data Transfer Addendum, in Vercel's data processing addendum. No Data Privacy Framework certification claimed |
| Neon (Neon, LLC, part of Databricks, Inc.) | The database. Every brand, affiliate, deal and message record lives here. | United States, AWS us-east-1 | EU-US Data Privacy Framework with the UK Extension, backed by the 2021 Standard Contractual Clauses and the UK Addendum in the Databricks data processing addendum |
| Stripe (Stripe, Inc.) | Takes subscription payments. | United States, with Stripe Payments Europe in Ireland for European customers | Standard Contractual Clauses, the UK Addendum and Data Privacy Framework self-certification, through Stripe's data transfers addendum |
| Resend (Plus Five Five, Inc.) | Sends account emails, the weekly fresh-affiliates email and the Enterprise form auto-reply. | United States | EU-US Data Privacy Framework with the UK Extension, plus the EU Standard Contractual Clauses and the UK Addendum in its data processing agreement |
| Unipile (Unipile SAS) | Connects a founder's mailbox, sends approved outreach and receives replies. Advance notice: not in use yet. | France, with providers in France, Lithuania and Israel | UK adequacy regulations cover these locations |
| PostHog (PostHog, Inc.) | Counts which pages help. Cookieless until a visitor accepts. | United States (us.i.posthog.com) | EU-US Data Privacy Framework with the UK Extension, plus the Standard Contractual Clauses and the UK Addendum |
| Sentry (Functional Software, Inc.) | Error reports, with personal data stripped before sending. | United States (ingest.us.sentry.io) | Data Privacy Framework, with the Standard Contractual Clauses and the UK Addendum as the fallback. Addendum version 5.1.0, 29 May 2024 |
| DataForSEO (DataForSEO OÜ) | Finds public websites for a search phrase, country and language, and estimates their traffic. | Estonia, with infrastructure in Germany and the United States | Its privacy policy incorporates its data processing agreement: Standard Contractual Clauses or an adequacy decision |
| YouTube Data API (YouTube LLC, part of Google LLC) | Searches public channels and reads public video metadata. Never connects to a creator's account. | United States and Google's global infrastructure | Google LLC is certified under the EU-US Data Privacy Framework and its UK Extension, with Standard Contractual Clauses where adequacy does not cover a transfer |
| OpenRouter (OpenRouter, Inc.) | Routes our AI requests to the Qwen model, which sorts public websites and summarises a customer's website at setup. Never sent email addresses, mailbox content or payment data. | United States | We rely on OpenRouter's contractual data-protection commitments. We don't currently hold a signed data processing agreement with Standard Contractual Clauses for this transfer. Pinned to one model host, Alibaba Cloud, with fallback to other hosts switched off and no host that keeps or trains on prompts |
| Alibaba Cloud (Alibaba Cloud International, as the Qwen model host reached through OpenRouter) | Runs the Qwen model on what OpenRouter sends: public page titles, links and text, YouTube channel descriptions and video titles, and a customer's own website text. | Singapore and mainland China | Neither country has a UK or EU adequacy decision. Alibaba states it does not use this data to train models. We rely on OpenRouter's contractual data-protection commitments; we do not currently hold a signed data processing agreement with Standard Contractual Clauses for this transfer. We send public web text and a customer's own website text only |
| Hunter (Hunter Web Services, Inc., Wilmington, Delaware, United States) | Finds and verifies a work email for a public website domain, only when a customer asks for an address. | Belgium (Hunter's servers), run by a US company | UK adequacy regulations cover the EU. For anything Hunter moves outside the EEA or the UK, its privacy policy relies on the Standard Contractual Clauses and the International Data Transfer Agreement |
| Icypeas (Icypeas, company no. 919561266, registered in France) | Finds and verifies a work email for a public website domain, when enabled, and only when a customer asks for an address. Advance notice: not in use yet. | France and the EEA (OVHcloud and Scaleway) | UK adequacy regulations cover the EEA. Its privacy policy says some processing may happen in other countries, including the United States |
| Upstash (Upstash, Inc.) | Short-lived rate-limit counters, for example how often one address can ask to be removed. Keyed by IP address or a scrambled code, and they expire on their own. | United States | EU-US Data Privacy Framework with the UK Extension, plus Standard Contractual Clauses |
| Inngest (Inngest, Inc.) | Runs scheduled and background work, such as scans and campaign sends. Sent record ids only. | United States | Not confirmed. A published data processing addendum is being requested |
Not on this list
Your own mailbox provider, such as Google or Microsoft. You chose it and your agreement with it is yours. We connect to it through Unipile, which is on the list.
Podcast Index (podcastindex.org). We send it search words, such as your keywords and competitors' names, and it tells us which public podcast feeds to read. It never gets personal data from us, so it isn't a sub-processor.
Questions
Email support@recruitaffiliates.ai. If your buying process needs a signed copy of the data processing agreement, say so and we'll send one.