◆ Compliance · GDPR Article 28
Subprocessors
Third-party services Zay Revenue Group uses to deliver Zay-OS, Zay CRM for existing accounts, and the public tools we have retired, whose records we still hold. Updated whenever we add or remove a vendor. EU and UK customers are notified by email before any new subprocessor begins processing your data.
Last updated October 4, 2026
Stripe, Inc.
DPA →- Purpose
- Subscription billing + Stripe Connect (your CRM tier subscription, your clients' invoice payments via your connected Stripe).
- Data types
- Email, name, billing address, payment method tokens (card data tokenized — not stored on our servers).
- Location
- United States
- Transfer
- Stripe Inc. — DPA signed; SCCs in place per Stripe's standard data processing addendum.
Square, Inc.
DPA →- Purpose
- One-time card payments for the public Lead Finder and SEO Audit tools (via Square Web Payments SDK). Both tools are retired (30 July 2026 and 30 May 2026) and take no new payments. Records of past purchases are kept for 7 years as financial records.
- Data types
- Email, name, billing address, payment method tokens.
- Location
- United States
- Transfer
- Square Inc. — DPA + SCCs.
Resend, Inc.
DPA →- Purpose
- Transactional email delivery (signup confirmation, password reset, magic links, drip sequences, customer notifications).
- Data types
- Recipient email + name, email body content.
- Location
- United States
- Transfer
- Resend — DPA available; SCCs available on request.
Google LLC (Google Workspace + Gemini API)
DPA →- Purpose
- Email hosting (zayrev.com mailboxes), Gemini AI generation when customer enables AI features and bring-your-own Gemini key.
- Data types
- Email content, AI prompt content (only when customer triggers AI).
- Location
- United States
- Transfer
- Google Workspace DPA + SCCs.
Anthropic, PBC
DPA →- Purpose
- Claude AI generation when customer enables AI features and bring-your-own Anthropic key.
- Data types
- AI prompt content + responses (transient — not used for training when API is called with a paid key).
- Location
- United States
- Transfer
- Anthropic Commercial Terms.
OpenAI, L.L.C.
DPA →- Purpose
- OpenAI / GPT generation when customer enables AI features and bring-your-own OpenAI key.
- Data types
- AI prompt content + responses.
- Location
- United States
- Transfer
- OpenAI DPA available.
Cloudflare, Inc.
DPA →- Purpose
- DNS + edge CDN + R2 file storage (your CRM file uploads).
- Data types
- Files you upload (contracts, signed PDFs, attachments) + DNS query metadata.
- Location
- United States (R2 hosted in chosen region).
- Transfer
- Cloudflare DPA + SCCs.
Fly.io, Inc.
DPA →- Purpose
- Compute hosting (the API server you connect to).
- Data types
- All data your CRM stores in Postgres (encrypted at rest).
- Location
- United States (Iad region by default).
- Transfer
- Fly.io Privacy Statement + SCCs.
Vercel, Inc.
DPA →- Purpose
- Static asset hosting (the marketing site + CRM frontend bundle).
- Data types
- No customer PII — only static HTML/JS/CSS plus standard request logs (IP, user-agent, referrer).
- Location
- United States.
- Transfer
- Vercel DPA + SCCs.
Calendly, LLC (only when customer connects Calendly integration)
DPA →- Purpose
- Meeting scheduling sync.
- Data types
- Meeting attendee email + name + scheduled time.
- Location
- United States.
- Transfer
- Calendly DPA via integration consent.
Twilio, Inc. (only when customer enables SMS / voice)
DPA →- Purpose
- SMS + voice delivery (transactional SMS, dialer, call recording, Voice Intelligence transcription).
- Data types
- Recipient phone number + message body + call audio (when recorded) + transcript text.
- Location
- United States.
- Transfer
- Twilio DPA + SCCs.
RocketReach, LLC (only when user clicks Enhance)
DPA →- Purpose
- Contact enrichment for the Lead Finder inside the CRM + Companies enhance flow. The public AI Lead Finder page was retired on 30 July 2026.
- Data types
- Person name + company name as query input.
- Location
- United States.
- Transfer
- RocketReach Commercial Terms.
Google LLC (Places API)
DPA →- Purpose
- Business lookup for the Lead Finder inside the CRM. The public AI Lead Finder page was retired on 30 July 2026.
- Data types
- Search query (business type + location) only — no customer PII.
- Location
- Global.
- Transfer
- Google API Terms + DPA.
Google LLC (PageSpeed Insights API)
DPA →- Purpose
- Performance scoring for the SEO Audit tool. The public SEO Audit page was retired on 30 May 2026.
- Data types
- Website URL only — no PII.
- Location
- Global.
- Transfer
- Google API Terms.
Object to a subprocessor
EU and UK customers have the right to object to a subprocessor processing their data. Contact us before the change takes effect and we will work with you on a resolution (alternative provider, contract change, or termination with refund of unused term).
support@zayrev.com