PetalCRM sub-processors
Last updated: 17 October 2026
These are the companies that process personal data for us when a business uses PetalCRM. Our customers authorise them in our Data Processing Agreement. Each is bound by a written contract with data-protection duties, and we stay responsible for their work.
Who processes your workspace data
| Sub-processor | What it does | Where |
|---|---|---|
| Google Cloud (Google LLC and its affiliates) | Hosts our application and background services; message queues, encryption keys, secrets and logs. Runs the AI model only for the demonstration workspaces we create, which hold fictional data (Vertex AI). | Belgium and Germany. Logs and the demonstration model in Google's global location. |
| Supabase | Our main database and its backups | Frankfurt, Germany (AWS eu-central-1) |
| OpenAI (OpenAI OpCo, LLC; OpenAI Ireland Ltd for data from the European Economic Area) | The AI model for customer workspaces: it processes the workspace data a customer puts into PetalCRM (email, records, imported files, chat messages, setup) to suggest updates, drafts, summaries, field mappings and answers that a person reviews; it does not train on that data | United States and other OpenAI processing locations |
| Anthropic (Anthropic, PBC) | May be used as an alternative AI model provider. It serves no customer workspace today. | United States and other Anthropic processing locations |
| Cloudflare | DNS. Carries and decrypts web traffic to workspace addresses and passes it to our servers. Receives email sent to a workspace's PetalCRM address and stores it briefly until we collect it. | Received at Cloudflare's nearest server, which may be outside the EU. Email is stored in the EU. |
| Resend (Plus Five Five, Inc.) | Sends sign-in and invitation emails, from mail.petalcrm.ai |
Mainly the United States |
Our database and main services are hosted in the EU. Where a sub-processor works outside the European Economic Area, the UK and Israel, the transfer relies on the European Commission's Standard Contractual Clauses (with the UK Addendum for UK data), or on the EU-U.S. Data Privacy Framework where the company is certified.
Product analytics
| Provider | What it does | Where |
|---|---|---|
| PostHog (PostHog Inc.) | Product analytics | EU (Frankfurt, Germany) |
Payments
Paid plans are sold by Polar (Polar Software, Inc., United States) as merchant of record. A buyer gives their billing and payment details to Polar on Polar's own checkout page, and Polar handles them as the seller, under its own terms and privacy policy. Polar receives no workspace content and no personal data from a workspace, so it is not a sub-processor of workspace data. It tells us which plan was bought, how many seats, and the subscription's status.
When this list changes
We email each customer at least 14 days before we add or replace a sub-processor. A customer may object in that time on reasonable data-protection grounds, as our Data Processing Agreement sets out.