Effective: 5 October 2026
1. What this list is for
1.1 This list names the companies involved in processing personal data in the HypeLead service (the “Service”), run by HypeDigitaly s.r.o., company ID (IČO) 17665655, registered office Velká Hradební 2800/54, 400 01 Ústí nad Labem, Czech Republic.
1.2 The list has three parts:
- sub-processors of customer data (the Data Processing Agreement and the right to object apply to them),
- suppliers for our own data, for which we are the controller (the Prospeo row in section 3 describes one case where we act for the customer),
- services that belong to the customer and are not our processors.
1.3 We store Service data in the European Union. The one exception is the encrypted copy of our backups kept with Google (section 2), which Google may store outside the European Economic Area. For each supplier outside the EEA, the tables state the safeguard: the EU-US Data Privacy Framework where the supplier is certified, the standard contractual clauses approved by the European Commission (with a written transfer impact assessment where they are the only safeguard), or an adequacy decision of the European Commission. Where a supplier has given us no safeguard, the table says so (today Serper.dev).
2. Sub-processors of customer data
| Supplier | What we use it for | What data | Where |
|---|---|---|---|
| Hetzner Online GmbH | Hosting of the app, database, backups and website | All data in the Service | Server in Finland (Helsinki), including the backups kept on it (EU) |
| Google Cloud EMEA Limited (Google Workspace, Google Drive) | Storage of a copy of the database backups outside our server. Each backup is encrypted on our server before it is uploaded; only we hold the key, so Google cannot read the content | All data in the Service, in encrypted form only. We delete each copy after at most 30 days; Google then removes it from its systems within at most 180 days | Contracting party in Ireland; Google may store the data in any country where Google or its sub-processors have data centres, including the USA; transfers to Google LLC (USA) under the EU-US Data Privacy Framework, with the standard contractual clauses in Google’s Cloud Data Processing Addendum as a fallback |
| OpenRouter, Inc. | Gateway that passes AI tasks to model providers; every request allows it only OpenAI, Anthropic and Google | Task inputs: names, text about companies, message drafts, reply content | USA; EU standard contractual clauses (with the UK addendum) |
| OpenAI | AI models (through OpenRouter), including the in-app assistant, and turning text into vectors for knowledge-base search | The same task inputs and text chunks from the knowledge base, which may contain personal data; while processing | USA; reached only through OpenRouter, which engages it as its own sub-processor; the transfer from the EU goes to OpenRouter under the safeguards in its row |
| Anthropic | AI models (through OpenRouter) | The same task inputs, while processing | USA; reached only through OpenRouter, which engages it as its own sub-processor; the transfer from the EU goes to OpenRouter under the safeguards in its row |
| Google (Vertex AI, AI Studio) | AI models such as Gemini (through OpenRouter) | The same task inputs, while processing | USA; reached only through OpenRouter, which engages it as its own sub-processor; the transfer from the EU goes to OpenRouter under the safeguards in its row |
| Unipile (Unipile SAS) | Connection to LinkedIn accounts the customer connects: sending and receiving messages | Contact details, message content, account connection data | France (EU); servers at Scaleway and OVH in France |
| Resend (Resend, Inc.) | Delivery of emails from the Service, including invitations a workspace sends to team members | Email, name, workspace name, links in the email | Sending from the EU; the company is based in the USA, transfers under the EU-US Data Privacy Framework and standard contractual clauses |
| Serper.dev | Web search when the Customer has the Service find email addresses or other contact details for contacts in its contact list, including contacts imported from a file | Search queries written by artificial intelligence: the company name and web address and, where the AI includes it, the name of the Customer’s contact or of another person it read on a web page | Not published by the supplier (its terms are governed by the law of the United Kingdom); not certified under the EU-US Data Privacy Framework; the supplier has given us no data processing agreement and no standard contractual clauses, so no transfer safeguard applies |
3. Suppliers for our own data
For these suppliers we are the controller, except in the case described in the Prospeo row. They are not sub-processors of customer data, so the customer’s right to object under the Data Processing Agreement does not apply to them. We list them for completeness.
| Supplier | What we use it for | What data | Where |
|---|---|---|---|
| Stripe | Seller of subscriptions (merchant of record, “Sold through Link”), payments, invoices and taxes. For the sale it is an independent controller. | Billing details, last 4 digits and type of card, payment identifiers | Contracting party Stripe Technology Europe, Limited (Ireland); seller Sold through Link, LLC (USA); transfers to Stripe, LLC (USA) under the EU-US Data Privacy Framework and standard contractual clauses |
| Prospeo (Defastra Tech Inc.) | Company and contact database, revealing work emails and phone numbers. When a customer has the Service find email addresses or phone numbers for contacts it imported from a file, we act as the customer’s processor and, on the customer’s instruction, send Prospeo the details needed for the lookup. Prospeo receives them as a recipient and independent controller, not as our sub-processor (Data Processing Agreement, section 3.4), so the customer’s right to object does not apply to it | Search filters; for a lookup of a person: the name, email address and profile link (for example LinkedIn), the company name and web address and, where available, the company’s LinkedIn page and Prospeo’s own record number for the person; returns contact details | Canada (Toronto), Amazon Web Services servers in the USA; transfers to Canada under the European Commission’s adequacy decision, to the USA under standard contractual clauses |
| Serper.dev | Web and news search for company research and for finding contacts at a company | Search queries. Most are about companies (company name, web address, place). When the Service looks for contacts at a company or researches a company in depth, artificial intelligence writes the queries, and they may contain the name of a person, for example a name read on the company’s website or the name of a contact we already hold | Not published by the supplier (its terms are governed by the law of the United Kingdom); not certified under the EU-US Data Privacy Framework; the supplier has given us no data processing agreement and no standard contractual clauses, so no transfer safeguard applies |
| Clearbit (HubSpot) | Company name suggestions while typing on the entry screen | Text the user types | USA (HubSpot, Inc.); transfers under the EU-US Data Privacy Framework; no separate contract, we use the free public interface under the Clearbit and HubSpot terms |
| Google (website icon service) | Company logos | Domain names only, no personal data | USA |
| Google Cloud EMEA Limited (Google Workspace, Google Drive) | Also the encrypted copy of the backups of our own data (for example accounts, billing, lead data, waitlist) | See section 2 | See section 2 |
| Resend | Also our own emails: sign-up, billing, the waitlist welcome email, the internal notice to the HypeDigitaly team of a new waitlist sign-up and product news for those who asked for it | Email, name; for the sign-up notice also the form language, the sign-up time, the campaign tags from the link and the fit rating A, B or C (no phone) | See above |
| Google Analytics 4 (Google Ireland Limited) | Website traffic: on the main website only after consent in the cookie banner; on the waitlist page from arrival, switchable off in Cookie settings (legitimate interest). Once linked to Google Ads, Google Ads imports as a conversion only the event that a person saved their details in the second waitlist step | Pseudonymous identifier, pages, events, approximate location at city level, device data; data is kept for 2 months | Ireland; transfers to Google LLC (USA) under the EU-US Data Privacy Framework and standard contractual clauses |
| Meta Pixel (Meta Platforms Ireland Limited) | Measuring Facebook and Instagram ads: on the main website (hypelead.ai) only after consent in the cookie banner (consent); on the waitlist page from arrival, switchable off in Cookie settings (legitimate interest); joint controller for collection, Meta is a separate controller afterwards. Once switched on, also reporting sign-ups directly from our server (Meta Conversions API) | Pseudonymous identifier (_fbp, _fbc), IP address, pages, browser and device data, the fact of a waitlist sign-up, possibly a hash of contact details from a form, for example email or phone number (automatic advanced matching) | Ireland; transfers to Meta Platforms, Inc. (USA) under the EU-US Data Privacy Framework |
| Cal.com | Booking the onboarding call (the website only links to it) | Name, email, time, answers | USA; transfers under the EU-US Data Privacy Framework |
| Public registers: ARES (Czech Republic), VIES (European Commission), HMRC and Companies House (United Kingdom), Brønnøysund Register Centre (Norway), UID register (Switzerland), SEC EDGAR (USA) | Checking a company and VAT ID and prefilling billing details; ARES also for data about Czech companies | Company IDs and names | Per register |
| Let’s Encrypt | Certificates for customers’ own tracking domains | Domain names only, no personal data | USA |
4. Services that belong to the customer
The customer connects these services itself and has its own contract with them. They are not our processors.
- the customer’s email mailboxes (Google Workspace or Gmail, Microsoft 365 through Microsoft Graph, other mailboxes over IMAP),
- the customer’s LinkedIn account,
- the customer’s booking tool (Calendly or Cal.com), if connected,
- mailboxes of other members of the warm-up pool (see section 9 of the Terms of Service),
- sign-in with Google, if the user uses it (Google is an independent controller for sign-in).
5. What we run ourselves
We run the database, monitoring, speech-to-text and control of outbound connections on our own servers at Hetzner. They add no further supplier or country.
6. Notice of changes
6.1 We announce a new sub-processor of customer data at least 15 days in advance. The customer may object within 15 days under the Data Processing Agreement.
6.2 To receive notices of changes by email, write to info@hypedigitaly.ai with the subject “Sub-processor updates”.
6.3 Each version of this list has an effective date and stays available at a permanent link.
Want to hear when the list changes? Write to us at info@hypedigitaly.ai.