Data Subprocessors
Last updated: 31 October 2026. Version: 2026-10-31
Purpose and Engagement Criteria
Prospectly ("we", "us") engages third-party service providers ("subprocessors") to supply cloud infrastructure, payment processing, artificial intelligence inference, transactional communications, and local business data enrichment.
In compliance with the Brazilian General Data Protection Law (LGPD - Law No. 13,709/2018) and the General Data Protection Regulation (GDPR), we carefully select vendors that maintain appropriate technical and organizational security measures to protect personal data. For more details on legal bases and data-subject rights, please consult our Privacy Policy.
List of Subprocessors
The table below outlines our integrated technology partners, their operational scope, the categories of data processed, and their respective operational jurisdiction.
| Subprocessor | Function / Role | Data Processed | Country / Region |
|---|---|---|---|
| Hostinger International Ltd. | Platform hosting on a virtual private server (VPS) running Docker Compose: API, background worker, Web app, landing site, PostgreSQL 16 database, and Redis 7 cache. | Account and organization profile data, search history, saved prospecting pipeline leads, and technical system logs. | Brazil (VPS data center) |
| Asaas Gestão Financeira Instituição de Pagamento S.A. CONFIRMAR | Current payment processing; will be replaced by AbacatePay (pending implementation). | Customer name, tax ID (CPF/CNPJ), email, phone number, billing address, and transaction status. Credit card numbers are captured directly on Asaas hosted checkout. | Brazil |
| Cloudflare, Inc. (Cloudflare Workers AI) | Primary artificial intelligence provider (model @cf/openai/gpt-oss-120b) for AI features: opportunity explanations, WhatsApp message suggestions, and the in-app assistant (off by default, enabled per organization). Does not use the content to train models and does not retain inputs or outputs after serving the request, as long as AI Gateway logs, caching, or batch processing are not enabled. | Minimized and sanitized content from the lead context (public business data such as name, category, city, and commercial signals) and from the assistant conversation. Contact email, phone number, and address are omitted before transmission. | USA / Global (international transfer) |
| Groq, Inc. (Groq Cloud) | Fallback provider for the same AI features, used when the primary provider is unavailable. By default does not retain inference data and keeps abuse and reliability logs for up to 30 days. | The same minimized and sanitized lead and conversation content sent to the primary provider. | USA (international transfer) |
| OpenStreetMap Foundation | Public cartographic data and geocoding points of interest (Nominatim and Overpass APIs). | Geographic coordinates, municipality/neighborhood names, and commercial query keywords (no user personal data). | UK / Germany |
| Google LLC (Google Places API & Maps) | Discovery and enrichment of publicly available local commercial place details. | Business search terms, geographic bounding coordinates, and public Google place IDs. | USA |
| Google LLC (Google Identity Services / OAuth) | Federated single sign-on (Sign-In with Google) and voluntary assisted outreach integration (Gmail/Calendar). | User name, email address, public profile avatar, and granted OAuth authorization tokens. | USA |
| Resend Inc. | Transactional email delivery (account confirmation, email verification links, and operational alerts). | Recipient email address, name, message subject, and transactional message body. | USA |
Note: Items marked with the CONFIRMAR badge are subject to operational confirmation or technical transition in production:
- Asaas: current payment processor in transition (will be replaced by AbacatePay, pending code implementation).
All subprocessors without a badge have verified active operation in our production infrastructure.
International Data Transfers and Safeguards
Platform hosting and the database are located in Brazil. Certain subprocessors operate infrastructure located outside Brazil, predominantly in the United States (Google, Cloudflare, Groq, and Resend) and in the United Kingdom and the European Union (OpenStreetMap). In such cases, Prospectly mandates strict contractual safeguards, adherence to internationally recognized security standards, and comprehensive encryption in transit and at rest.
For privacy inquiries, subprocessor queries, or data-subject requests, please reach out to our privacy team at: privacy@prospectly.dev.