◆ Compliance · GDPR Article 28
Subprocessors
Third-party services Zay Revenue Group uses to deliver Zay CRM, Zayos, and our public tools. Updated whenever we add or remove a vendor. EU and UK customers are notified by email before any new subprocessor begins processing your data.
Stripe, Inc.
DPA →- Purpose
- Subscription billing + Stripe Connect (your CRM tier subscription, your clients' invoice payments via your connected Stripe).
- Data types
- Email, name, billing address, payment method tokens (card data tokenized — not stored on our servers).
- Location
- United States
- Transfer
- Stripe Inc. — DPA signed; SCCs in place per Stripe's standard data processing addendum.
Square, Inc.
DPA →- Purpose
- Public lead-finder + SEO audit purchases (one-time card payments via Square Web Payments SDK).
- Data types
- Email, name, billing address, payment method tokens.
- Location
- United States
- Transfer
- Square Inc. — DPA + SCCs.
Resend, Inc.
DPA →- Purpose
- Transactional email delivery (signup confirmation, password reset, magic links, drip sequences, customer notifications).
- Data types
- Recipient email + name, email body content.
- Location
- United States
- Transfer
- Resend — DPA available; SCCs available on request.
Google LLC (Google Workspace + Gemini API)
DPA →- Purpose
- Email hosting (zayrev.com mailboxes), Gemini AI generation when customer enables AI features and bring-your-own Gemini key.
- Data types
- Email content, AI prompt content (only when customer triggers AI).
- Location
- United States
- Transfer
- Google Workspace DPA + SCCs.
Anthropic, PBC
DPA →- Purpose
- Claude AI generation when customer enables AI features and bring-your-own Anthropic key.
- Data types
- AI prompt content + responses (transient — not used for training when API is called with a paid key).
- Location
- United States
- Transfer
- Anthropic Commercial Terms.
OpenAI, L.L.C.
DPA →- Purpose
- OpenAI / GPT generation when customer enables AI features and bring-your-own OpenAI key.
- Data types
- AI prompt content + responses.
- Location
- United States
- Transfer
- OpenAI DPA available.
Cloudflare, Inc.
DPA →- Purpose
- DNS + edge CDN + R2 file storage (your CRM file uploads).
- Data types
- Files you upload (contracts, signed PDFs, attachments) + DNS query metadata.
- Location
- United States (R2 hosted in chosen region).
- Transfer
- Cloudflare DPA + SCCs.
Fly.io, Inc.
DPA →- Purpose
- Compute hosting (the API server you connect to).
- Data types
- All data your CRM stores in Postgres (encrypted at rest).
- Location
- United States (Iad region by default).
- Transfer
- Fly DPA + SCCs.
Vercel, Inc.
DPA →- Purpose
- Static asset hosting (the marketing site + CRM frontend bundle).
- Data types
- No customer PII — only static HTML/JS/CSS plus standard request logs (IP, user-agent, referrer).
- Location
- United States.
- Transfer
- Vercel DPA + SCCs.
Calendly, LLC (only when customer connects Calendly integration)
DPA →- Purpose
- Meeting scheduling sync.
- Data types
- Meeting attendee email + name + scheduled time.
- Location
- United States.
- Transfer
- Calendly DPA via integration consent.
Twilio, Inc. (only when customer enables SMS / voice)
DPA →- Purpose
- SMS + voice delivery (transactional SMS, dialer, call recording, Voice Intelligence transcription).
- Data types
- Recipient phone number + message body + call audio (when recorded) + transcript text.
- Location
- United States.
- Transfer
- Twilio DPA + SCCs.
RocketReach, LLC (only when user clicks Enhance)
DPA →- Purpose
- Contact enrichment for AI Lead Finder + Companies enhance flow.
- Data types
- Person name + company name as query input.
- Location
- United States.
- Transfer
- RocketReach Commercial Terms.
Google LLC (Places API)
DPA →- Purpose
- Business lookup for AI Lead Finder.
- Data types
- Search query (business type + location) only — no customer PII.
- Location
- Global.
- Transfer
- Google API Terms + DPA.
Google LLC (PageSpeed Insights API)
DPA →- Purpose
- Performance scoring for the SEO Audit tool.
- Data types
- Website URL only — no PII.
- Location
- Global.
- Transfer
- Google API Terms.
Object to a subprocessor
EU and UK customers have the right to object to a subprocessor processing their data. Contact us before the change takes effect and we will work with you on a resolution (alternative provider, contract change, or termination with refund of unused term).
support@zayrev.com