Legal
Sub-processors
The outside companies that may process personal data you keep in AutomateNexus CRM.
Last updated · 10 November 2026
01About this list
These are the outside companies we use to run AutomateNexus CRM that may process personal data you keep in the CRM. Each one gets only the data it needs for its job, under data protection terms no less protective than our Data Processing Addendum.
Our Data Processing Addendum covers transfers outside the EU, the UK and Switzerland with the EU Standard Contractual Clauses and the UK Addendum. This list is the sub-processor list that section 7 of the Addendum refers to, and Annex III of the Standard Contractual Clauses.
02Used for every workspace
These companies handle data for every workspace, whichever features you use.
| Company | What it does for us | Data it handles | Where |
|---|---|---|---|
| Supabase, Inc. (on Amazon Web Services) | Database, sign-in, file storage and the server functions that run the CRM | Everything stored in the CRM | United States (Ohio) |
| Amazon Web Services, Inc. | The servers that run the web app | Pages and requests as you use the app | United States (Oregon) |
| Cloudflare, Inc. | Security, delivery and DNS for the app and your custom domains, bot checks on forms, and storage for some media files | Requests to the app and your sites, IP addresses, files you upload to some features | Global network; United States company |
| Emailit | The emails the CRM sends for you and your team: invoices, quotes, reminders, receipts, signature requests, sign-in and account emails | Recipient names and addresses, the email's content | Czech Republic (EU) |
| Resend, Inc. | Backup for the same emails, used only when Emailit cannot send | Recipient names and addresses, the email's content | United States |
| Stripe, Inc. | Billing for your AutomateNexus CRM subscription | Your billing name, email and payment details | United States |
03Used only when you use the feature
These companies handle data only when you, or someone in your workspace, uses the feature described. If you never use it, they receive nothing from your workspace.
| Company | What it does for us | Data it handles | Where |
|---|---|---|---|
| OpenRouter, Inc. | AI features running on AI credits from us, instead of your own AI key | The text of the AI request: the records and messages you ask the AI about | United States |
| OpenAI, L.L.C. | Knowledge base search: turning your articles into a searchable form | The text of your knowledge base articles and the questions asked | United States |
| TypeSafe AI | Quick decision checks inside some AI features | The short question and the details of the record it is about | United States |
| Deepgram, Inc. | Call transcription, when you have not connected your own Deepgram key | Call recordings | United States |
| Amazon Web Services, Inc. (Simple Email Service) | Email campaigns sent with sending credit from us, instead of your own email provider | Recipient names and addresses, campaign content | United States |
| Apple Inc. | Phone app notifications on iPhone, and business cards added to Apple Wallet | Notification text, card details | United States |
| Google LLC | Phone app notifications on Android, and business cards added to Google Wallet | Notification text, card details | United States |
| Automattic Inc. (Gravatar) | Finding public profile photos for your contacts | A one-way scrambled form (hash) of the contact's email address | United States |
| Mapbox, Inc. | Maps on person and company pages | The town or address shown on the map | United States |
04Services you connect yourself
When you connect your own account with another service, that service works for you under its own terms, not as our sub-processor. For example: your own AI key (OpenAI, Anthropic, Google, DeepSeek, Perplexity and others), Twilio, WhatsApp, Gmail and Google Calendar, Microsoft 365 and Outlook, Zoom, Stripe for taking your customers' payments, QuickBooks, Xero, payroll services, Dropbox, Box, Facebook and Instagram, and LinkedIn.
The companies that help us run our own business with you, such as our support inbox and our affiliate programme, handle your account details and messages to us, not the data in your CRM. Our Privacy Policy covers them.
05Changes to this list
We update this page before a new sub-processor starts processing personal data you keep in the CRM, and we give at least 30 days' notice by email to your account owner or by a notice in the app, as section 7 of the Data Processing Addendum describes. You may object on reasonable data protection grounds within that period.
Last updated · 10 November 2026
Questions about how a sub-processor handles your data? Write to support@automatenexuscrm.com.