Beolta — Subprocessor List
Operated by: Editale OÜ (registry code 17430609), Narva mnt 7-557, 10117 Tallinn, Estonia Last updated: 2026-08-05 Version: 1.6.0
Changes to this list are announced via email and in-app notification at least 30 days before a new subprocessor is added or materially changed. You may object to a new subprocessor on reasonable data-protection grounds within 14 calendar days of that notice, as set out in Article 8 of the Data Processing Agreement (see also Section 8.6 of the Terms of Service).
Current Subprocessors
| Subprocessor | Role | Data Processed | Location | Transfer Mechanism |
|---|---|---|---|---|
| Supabase, Inc. | Database hosting, authentication, file storage | All Personal Data stored in the Services (account data, usage logs, ToS acceptance records, contractor profiles, buyer-side contact data) | EU (Frankfurt, AWS eu-central-1) | Intra-EEA — no transfer outside EEA |
| Railway Corp. | Web application hosting (app.beolta.com, SSR) | HTTP request metadata, session data, application logs | US / EU | SCCs (EC Decision 2021/914) Module 3 |
| Amazon Web Services, Inc. (AWS Amplify) | Static-site hosting (beolta.com landing) | Web server access logs | EU (eu-west-1) default; CDN edges global | SCCs Module 3 for any non-EEA edge cache; otherwise intra-EEA |
| Stripe, Inc. | Payment processing and billing | Billing name and address; tokenised payment-method details; invoice records | US / EU | SCCs; PCI DSS Level 1 certified; EU–US Data Privacy Framework where applicable |
| Anthropic, PBC | AI model inference (research briefs, outreach drafts) | Prospect and company context included in prompts. Also transmitted, for inbound-reply classification and reply drafting: the sender address and the verbatim body text of replies received to Beolta outreach, including any personal data the sender places in the message body or signature block. Senders include registered contractor users who reply to outreach, so registered-user personal data is transmitted. | US | SCCs; EU–US Data Privacy Framework where applicable; API terms preclude training on customer data; prompts not retained beyond standard short-term operational logs |
| Functional Software, Inc. (Sentry) | Error monitoring and performance tracking | Stack traces; limited session context (user ID, email on error) | US | SCCs; EU–US Data Privacy Framework where applicable; data-minimisation configured |
| Trigger.dev Ltd | Background job processing (signal pipeline, retention, email digest) | Job payloads (may contain user IDs and prospect data while in flight) | EU / US | SCCs; EU–US Data Privacy Framework where applicable |
| Resend, Inc. | Transactional email delivery | Recipient email address; email content | US | SCCs; EU–US Data Privacy Framework where applicable |
| AC PM LLC (Postmark, an ActiveCampaign company) | Alternate transactional email transport for claim / verification mail; used in place of Resend when the EMAIL_CLAIM_PROVIDER environment variable selects it | Recipient email address and the full content of the message sent to that recipient (subject line and HTML body), together with send and delivery metadata | US (Chicago, Illinois); ActiveCampaign group processing locations include US, Ireland, Australia, Brazil and Costa Rica | SCCs; EU–US Data Privacy Framework where applicable, under the provider’s data processing terms |
| Unipile SAS | LinkedIn outreach API (connection requests, InMail, direct messages to buyer-side decision-makers) | Buyer-side decision-maker LinkedIn profile identifiers (LinkedIn URN / profile URL, display name) and the content of outreach messages sent to them; sender LinkedIn account identifiers | EU (France) | Intra-EEA — no transfer outside EEA |
| Enrich Labs FZ L.L.C. (InboxKit) | Cold-outreach mailbox provisioning and email-warmup infrastructure | Sender mailbox identity data (mailbox display names, usernames, mailbox email addresses on sender-controlled domains) and warmup peer-traffic recipient addresses; SMTP/IMAP credentials for provisioned mailboxes | UAE (Dubai); data processed in US / EU / UAE per InboxKit Privacy Policy | Standard Contractual Clauses (EC Decision 2021/914) per InboxKit's published Privacy Policy; engaged via acceptance of InboxKit's online terms (click-wrap), no separately negotiated DPA. The mailboxes InboxKit provisions are hosted by Google — Google LLC is disclosed separately below as a subprocessor in its own right, not as a hosting detail of this entry |
| Google LLC (Google Workspace — Gmail SMTP and IMAP) | Mailbox host for the cold-outreach channel: every outbound outreach message is submitted through smtp.gmail.com and every inbound reply is polled from imap.gmail.com. Mailboxes are provisioned through InboxKit but Beolta connects to Google directly | Recipient email address and the full content of every outbound outreach message; sender address and the full content of every inbound reply, including any personal data a recipient places in the message body or signature block; mailbox credentials and SMTP/IMAP connection metadata | US — mailboxes provisioned on US-region Google Workspace | SCCs; EU–US Data Privacy Framework where applicable, under Google’s data processing terms |
| Apollo.io, Inc. | B2B contact and company data enrichment (buyer-side contact sourcing) | Business contact data of buyer-side decision-makers (name, business email, business phone, business title, employer, public LinkedIn URL) | US | SCCs; Apollo operates under its own GDPR / CCPA compliance regime |
| People Data Labs, Inc. | B2B contact and company data enrichment (corroborating coverage) | Business contact data of buyer-side decision-makers (same categories as Apollo; overlapping coverage for cross-verification) | US | SCCs; PDL operates under its own GDPR / CCPA compliance regime |
| Hunter Web Services, Inc. | Business-email enrichment (email-finder, domain-search, email-verifier); fallback to Apollo in the decision-maker email cascade | Sent: buyer-side decision-maker first name + last name + employer company domain. Received and stored: business email address, deliverability / confidence score, and domain-level email patterns | US / EU | SCCs |
| Prospeo (api.prospeo.io) | Business-email finder in the decision-maker email cascade (contractor and buyer lanes) | Sent: a named decision-maker's first name + last name + employer company domain. Received and stored: that individual's business email address and the provider's confidence / verification status | EU/US — per the provider’s published privacy policy | SCCs where applicable, under the provider’s data processing terms |
| Peanuts SaaS Studio (Findymail) | Verified business-email finder in the decision-maker email cascade; falls through to Apollo / Hunter when unconfigured | Sent: a named decision-maker's first name + last name + employer company domain. Received and stored: that individual's business email address and the provider's verification status | Processing in Germany (EEA) per the provider’s published privacy policy | Processing within the EEA; SCCs where applicable for any onward transfer, under the provider’s data processing terms |
| Icypeas (app.icypeas.com) | Verified-only business-email finder in the decision-maker email cascade, positioned after Apollo | Sent: a named decision-maker's first name + last name + employer company domain. Received and stored: that individual's business email address, returned only where the provider reports it as verified | EU/US — per the provider’s published privacy policy | SCCs where applicable, under the provider’s data processing terms |
| Reoon Technology (Reoon Email Verifier) | Email deliverability verification — first-choice verifier for decision-maker email addresses when configured | Sent: the individual's business email address, for SMTP-level validation. Received and stored: the deliverability verdict and associated quality signals for that address | Outside the EEA — per the provider’s published privacy policy | SCCs where applicable, under the provider’s data processing terms |
| GBD Software as a Service Private Limited Company (MillionVerifier) | Email deliverability verification — primary verifier for decision-maker email addresses when Reoon is not configured | Sent: the individual's business email address, for SMTP-level validation. Received and stored: the deliverability verdict and associated quality signals for that address | Hungary (EU); the provider states personal data may also be processed outside the EEA | Intra-EEA (Hungary); SCCs where applicable for any onward transfer, under the provider’s data processing terms |
| TheirStack, S.L. | Public job-posting and technology-signal aggregation | Public job postings; company-level data; hiring-manager names only where publicly listed | EU (Spain) | Intra-EEA — no transfer outside EEA |
| Apify Technologies s.r.o. | Operator of scrapers against public marketplaces (Clutch, DesignRush, TechBehemoths, GoodFirms) | Public agency / contractor directory listings; public decision-maker profile snippets | US / EU | SCCs |
The list above is reproduced in identical form in Privacy Policy §6.1 and in Annex II of the Data Processing Agreement.
Beolta additionally acquires personal data from the public data sources described in Privacy Policy §5.2 — public registries, public agency directories, and similar conspicuously published business sources. Public data sources do not act as subprocessors in the Article 28 GDPR sense.
Removed Subprocessors
| Subprocessor | Role at removal | Removed on | Reason |
|---|---|---|---|
| Proxycurl Pte. Ltd. | LinkedIn data enrichment | 2026-05-13 | Discontinued — no longer used by any active ingestion path. Replaced by Apollo / PDL coverage. |
| PredictLeads (4see, Inc.) | Public signal aggregation (funding, hiring, executive changes) | 2026-05-19 | Service retired — coverage replaced by Apollo, TheirStack, Apify, and SEC EDGAR signals. |
| Clearbit (operated by HubSpot, Inc.) | B2B firmographic and contact enrichment | 2026-06-07 | Over-disclosed — no connector has ever been active in production. Removed from live disclosure tables to correct the over-disclosure. |
| OpenAI, LLC | AI model inference (fallback / supplementary) — as previously disclosed | 2026-08-05 | No code path; never integrated. No OpenAI SDK, API key, base URL or environment variable exists in the application. Removed from live disclosure tables to correct the over-disclosure, mirroring the Clearbit correction of 2026-06-07. |
| Lawyers.com | Public legal-services directory (data source, not a subprocessor) | 2026-07-15 | Retired in code — Cloudflare bot-management blocks every request. Coverage replaced by the Best Lawyers directory. |
Questions
Contact privacy@beolta.com with any questions about this subprocessor list.