Sub-processors

The third parties that process data on our behalf, what they do, and where they do it.

Effective: August 1, 2026 | Last updated: August 1, 2026

1. About this list

To run DashAPI and LinkMe we use a small number of vendors that process data on our behalf. Under the GDPR and UK GDPR these are our sub-processors; under US state privacy laws they are service providers or contractors. This page is the authoritative, current list referred to in ourData Processing Addendum.

Every sub-processor is bound by a written contract that limits it to processing on our documented instructions, requires appropriate security measures and confidentiality, and prohibits use of the data for its own purposes — including training AI models on customer content.

2. Current sub-processors

Sub-processor	Purpose	Data processed	Location	Applies to
Anthropic, PBC	Large language model processing for agents, summarisation, report generation, and enrichment features.	Content you submit to an AI feature and the context required to answer it.	United States	DashAPI
OpenAI, L.L.C.	Alternate large language model processing where selected for a workspace or feature.	Content you submit to an AI feature and the context required to answer it.	United States	DashAPI
Apple Inc.	App Store distribution, in-app purchase billing, push notification delivery, and on-device model frameworks.	Account identifiers and purchase records. On-device model processing does not transmit content to Apple or to us.	United States and regional Apple infrastructure	LinkMe
Stripe, Inc.	Subscription billing, payment processing, invoicing, and fraud screening.	Billing contact details and payment tokens. Full card numbers are handled by Stripe and are never stored by us.	United States and global Stripe infrastructure	DashAPI
Google LLC	Website analytics (Google Analytics 4), Google Calendar connection via OAuth, and web font delivery.	Website usage and device data; calendar metadata for connected accounts.	United States and global Google infrastructure	DashAPI, LinkMe, dashapi.ai
Microsoft Corporation	Microsoft 365 / Outlook calendar connection via Microsoft Graph OAuth.	Calendar metadata for connected accounts.	United States and global Microsoft infrastructure	DashAPI
Supabase, Inc.	Managed Postgres and edge functions used for website lead capture and LinkMe backend services.	Contact details submitted through our forms; LinkMe account and synchronised records.	United States	LinkMe, dashapi.ai
Cloudflare, Inc.	Website hosting, content delivery, TLS termination, and denial-of-service protection.	Request metadata including IP address and user agent.	Global edge network	dashapi.ai
Primary application hosting provider	Application servers, database, object storage, and backups for the DashAPI platform.	All customer content stored in the platform.	United States	DashAPI

Not every sub-processor is engaged for every customer. Which ones apply to you depends on the product, plan and features you use — for example, an AI model provider is engaged only when you use an AI feature, and a calendar provider only when you connect a calendar.

3. Affiliates

Our own affiliates and contractors may process customer data to provide support, engineering and security services. They act under the same contractual obligations, access controls and confidentiality commitments as our employees, on a least-privilege basis.

4. How we select and monitor them

We assess security posture, certifications, data handling and breach history before engaging a vendor.
We put a written data processing agreement in place, including confidentiality, security measures, audit and deletion obligations.
We grant each vendor the narrowest access that lets it do its job.
We review the list periodically and remove vendors we no longer need.
We remain responsible to you for a sub-processor's performance of its data protection obligations.

5. International transfers

Most of our sub-processors are in the United States. Where a transfer of personal data out of the EEA, the UK or Switzerland is involved, we rely on the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum, and on transfer risk assessments where required. See clause 8 of our Privacy Policy.

6. Notice of changes and objections

Before we add a new sub-processor that will process customer personal data, or replace an existing one, we will update this page and notify customers who have subscribed to change notices at least 30 days in advance. To subscribe, email support@dashapi.ai with the subject "sub-processor notices".

If you have a reasonable, documented objection on data protection grounds, tell us within 30 days of the notice. We will work with you in good faith to offer a commercially reasonable alternative. If we cannot, you may terminate the affected subscription and we will refund prepaid, unused Fees on a pro-rata basis.

We may engage a new sub-processor with shorter notice, or none, where it is necessary to respond to a security incident or to keep the service running; we will tell you as soon as we can afterwards.

7. Services you connect yourself

When you connect a third-party service, issue an API token, or point an external AI assistant at your workspace, that provider is not our sub-processor. You are directing us to send data to a system you chose, and that provider handles the data under your agreement with it. See clause 9 of theTerms of Service.

8. Contact

Questions about a sub-processor, or a request for its data protection documentation:support@dashapi.ai.