Effective: 27 September 2026
1. What this list is for
1.1 This list names the companies involved in processing personal data in the HypeLead service (the “Service”), run by HypeDigitaly s.r.o., company ID (IČO) 17665655, registered office Velká Hradební 2800/54, 400 01 Ústí nad Labem, Czech Republic.
1.2 The list has three parts:
- sub-processors of customer data (the Data Processing Agreement and the right to object apply to them),
- suppliers for our own data, for which we are the controller,
- services that belong to the customer and are not our processors.
1.3 We store Service data in the European Union. For suppliers outside the EEA we use standard contractual clauses with a transfer impact assessment, or the EU-US Data Privacy Framework where the supplier is certified.
2. Sub-processors of customer data
| Supplier | What we use it for | What data | Where |
|---|---|---|---|
| Hetzner Online GmbH | Hosting of the app, database, backups and website | All data in the Service | Germany or Finland (EU) [OWNER TO CONFIRM: exact data centre] |
| OpenRouter, Inc. | Gateway that passes AI tasks to model providers | Task inputs: names, text about companies, message drafts, reply content | USA [OWNER TO CONFIRM: transfer tool (SCC or DPF)] |
| OpenAI | AI model (through OpenRouter), including the in-app assistant | The same task inputs, while processing | USA [OWNER TO CONFIRM: region and transfer tool] |
| Anthropic | AI model (through OpenRouter) | The same task inputs, while processing | USA [OWNER TO CONFIRM: region and transfer tool] |
| Google (Vertex AI, AI Studio) | Gemini models (through OpenRouter) | The same task inputs, while processing | [OWNER TO CONFIRM: region and transfer tool] |
| Novita AI | AI model (through OpenRouter) | The same task inputs, while processing | [OWNER TO CONFIRM: seat, region and contract; the legal analysis recommends sending no personal data until a contract and transfer assessment exist] |
| SiliconFlow | AI model (through OpenRouter) | The same task inputs, while processing | [OWNER TO CONFIRM: seat, region and contract; the legal analysis recommends sending no personal data until a contract and transfer assessment exist] |
| DeepInfra | Turning text into vectors for knowledge-base search | Text chunks that may contain personal data | USA [OWNER TO CONFIRM: region and transfer tool] |
| Parasail | Backup for turning text into vectors | Text chunks that may contain personal data | [OWNER TO CONFIRM: seat, region and transfer tool] |
| Unipile | Connection to LinkedIn accounts the customer connects: sending and receiving messages | Contact details, message content, account connection data | [OWNER TO CONFIRM: seat and region] |
| Resend | Delivery of emails from the Service, including invitations a workspace sends to team members | Email, name, workspace name, links in the email | Sending from the EU [OWNER TO CONFIRM: company seat and transfer tool] |
3. Suppliers for our own data
For these suppliers we are the controller. They are not sub-processors of customer data, so the right to object under the Data Processing Agreement does not apply to them. We list them for completeness.
| Supplier | What we use it for | What data | Where |
|---|---|---|---|
| Stripe | Seller of subscriptions (merchant of record, “Sold through Link”), payments, invoices and taxes. For the sale it is an independent controller. | Billing details, last 4 digits and type of card, payment identifiers | [OWNER TO CONFIRM: Stripe contracting entity and transfer tool] |
| Prospeo | Company and contact database, revealing work emails and phone numbers | Search filters, names and domains; returns contact details | [OWNER TO CONFIRM: seat and region] |
| Serper.dev | Web and news search for company research | Search terms, which may contain a name | USA [OWNER TO CONFIRM: transfer tool] |
| Clearbit (HubSpot) | Company name suggestions while typing on the entry screen | Text the user types | USA [OWNER TO CONFIRM: contractual basis] |
| Google (website icon service) | Company logos | Domain names only, no personal data | USA |
| Resend | Also our own emails: sign-up, billing, waitlist confirmation and product news for those who asked for it | Email, name | See above |
| Google Analytics 4 | Website traffic, only after consent in the cookie banner | Pseudonymous identifier, pages, events, device data | [OWNER TO CONFIRM: Google entity and EU settings] |
| Cal.com | Booking the onboarding call (the website only links to it) | Name, email, time, answers | USA [OWNER TO CONFIRM: transfer tool] |
| GetLeads | Backup contact database supplier. Not in use today; we will announce the change before switching it on. | Same as Prospeo | [OWNER TO CONFIRM: seat and region] |
| Public registers: ARES (Czech Republic), VIES (European Commission), HMRC and Companies House (United Kingdom), Brønnøysund Register Centre (Norway), UID register (Switzerland), SEC EDGAR (USA) | Checking a company and VAT ID and prefilling billing details; ARES also for data about Czech companies | Company IDs and names | Per register |
| Let’s Encrypt | Certificates for customers’ own tracking domains | Domain names only, no personal data | USA |
4. Services that belong to the customer
The customer connects these services itself and has its own contract with them. They are not our processors.
- the customer’s email mailboxes (Google Workspace or Gmail, Microsoft 365 through Microsoft Graph, other mailboxes over IMAP),
- the customer’s LinkedIn account,
- the customer’s booking tool (Calendly or Cal.com), if connected,
- mailboxes of other members of the warm-up pool (see section 9 of the Terms of Service),
- sign-in with Google, if the user uses it (Google is an independent controller for sign-in).
5. What we run ourselves
We run the database, monitoring, speech-to-text and control of outbound connections on our own servers at Hetzner. They add no further supplier or country.
6. Notice of changes
6.1 We announce a new sub-processor of customer data at least 15 days in advance. The customer may object within 15 days under the Data Processing Agreement.
6.2 To receive notices of changes by email, write to info@hypedigitaly.ai with the subject “Sub-processor updates”.
6.3 Each version of this list has an effective date and stays available at a permanent link.
Want to hear when the list changes? Write to us at info@hypedigitaly.ai.