Last updated: 2026-11-11
A sub-processor is a third party that CleanSmartLabs LLC engages to process personal data on behalf of our customers. When you upload, import, or clean records in CleanSmart, that data belongs to you: you decide what goes in and why, and CleanSmartLabs processes it on your behalf, as a processor, to provide the Services. This page lists the vendors that help us do that.
Your data is hosted on DigitalOcean in the United States (San Francisco region). DigitalOcean is the only vendor whose data location we choose. Every other vendor processes data where its own terms say, as shown below.
Sub-processors
The three Contact Verification vendors (Telnyx, Geocodio, Reoon) receive data only when your organization has the add-on, verification is turned on for the run, and the result is not already cached. They receive only the specific phone numbers, addresses, or email addresses being checked, not the rest of the record.
| Vendor | Purpose | Data | Location | DPA / transfer mechanism |
|---|---|---|---|---|
| DigitalOcean | Application hosting, managed database, and in-memory data store | Everything CleanSmart stores or processes, including the files and records you upload or import | United States (San Francisco region) | DigitalOcean DPA (part of its Terms of Service). EU-U.S. Data Privacy Framework, with Standard Contractual Clauses as a fallback |
| Cloudflare (used via DigitalOcean) | Network edge and CDN in front of the CleanSmart app. Cloudflare is DigitalOcean's sub-processor for App Platform | Web traffic between your browser and the app | Global edge network (Cloudflare, Inc., United States) | Covered through DigitalOcean, which lists Cloudflare as its own sub-processor |
| Anthropic | In-app help chat | Your chat messages and conversation history, organization name, plan and subscription status, trial end date, and the name of the page you're on. No uploaded data unless you type it into the chat | United States | Anthropic DPA (accepted with its Commercial Terms). Standard Contractual Clauses, with UK and Swiss addenda |
| Stripe | Billing and subscriptions | Account holder email, organization name, and account identifiers. Card details are entered into Stripe's checkout and go to Stripe directly | Not specified by vendor (Stripe's DPA allows global processing) | Stripe DPA (part of the Stripe Services Agreement). EU-U.S. Data Privacy Framework, Standard Contractual Clauses, UK Addendum |
| Resend | Transactional email | Recipient email and name, and message content: invitation and password-reset links, processing summaries (dataset name, record counts), weekly summary counts, and billing notices | United States (vendor's primary processing location) | Resend DPA (accepted with its Terms of Service). EU-U.S. Data Privacy Framework and UK Extension, Standard Contractual Clauses, UK Addendum |
| Sender.net (UAB “Sender.lt”) | Marketing email list for account holders | Account holder email, first and last name, company, plan, trial dates, and sign-up status. No customer records | European Union (vendor based in Lithuania; its DPA allows processing elsewhere) | Sender DPA (part of its Terms of Service). Standard Contractual Clauses for its own sub-processors outside the EEA |
| Telnyx | Phone line-type lookup. Contact Verification add-on only | The phone numbers being checked | United States | Telnyx DPA (accepted with its agreement). EU-U.S. Data Privacy Framework, Standard Contractual Clauses, UK Addendum |
| Geocodio | U.S. address standardization. Contact Verification add-on only | The street addresses being checked (street, city, state, ZIP) | Germany (Hetzner) | Not available on our current Geocodio plan |
| Reoon | Email deliverability check. Contact Verification add-on only | The email addresses being checked | Not stated by vendor | Requested |
Anthropic's commercial terms state that inputs and outputs sent through its API are not used to train its models by default.
Analytics and browser services (independent controllers)
These services load in your browser when you use the CleanSmart app and receive data from your browser directly, not from CleanSmart's servers. They do not receive the files or records you upload. Microsoft states that it acts as an independent data controller for Clarity data, so we list these separately from the sub-processors above.
- Google Analytics (Google): product usage analytics. Receives page addresses, IP address, device and browser details, and cookies.
- Microsoft Clarity (Microsoft): session replay and heatmaps. Receives clicks, scrolls, and page layout. Clarity runs in Strict masking mode, which masks all on-screen text and form inputs, so the contents of your records are not captured.
- Google Fonts (Google): web fonts. Receives your IP address and browser details when fonts load.
Analytics on this website (cleansmartlabs.com) are described in our Privacy Policy.
Platforms you connect
HubSpot, Klaviyo, Mailchimp, Salesforce, and Shopify are not sub-processors. You connect them to CleanSmart and direct the import yourself, under your own agreement with each platform. The credentials you use to connect them are encrypted before they are stored.
Changes
We update this page before we add a new sub-processor. To be notified when it changes, email admin@cleansmartlabs.com.