Legal · Subprocessors
Subprocessor list.
What this is. The third-party providers SweetNote engages to deliver the B2B platform, each one's role, the data they touch, where they're located, and the contractual data-protection posture in place. This list is reviewed quarterly and updated; any change is communicated to active Customers with at least 30 days' written notice.
How to subscribe to changes. Active partners receive subprocessor-change notifications automatically at the email address on the MSA. To subscribe before signing, email legal@thesweetnote.com.
How to subscribe to changes. Active partners receive subprocessor-change notifications automatically at the email address on the MSA. To subscribe before signing, email legal@thesweetnote.com.
What's NOT on this list. Tools you wire yourself through SweetNote's Integrations page, your CRM, your team chat (Slack, Microsoft Teams), automation tools (Zapier), your data warehouse (Snowflake, BigQuery, Looker Studio), your payment system (Stripe, Givebutter, etc.), are your own subprocessors, not SweetNote's. You chose them; you maintain the relationship with them; they go on your privacy disclosures. SweetNote acts as a pass-through on your instructions when forwarding to a destination you configured. Sign-in with Google or Microsoft uses your own identity provider account; that provider is your vendor, not a SweetNote subprocessor. The list below covers only the infrastructure SweetNote engages directly to operate the platform.
1. Current subprocessors
The providers below process Personal Data on SweetNote's behalf in the operation of the B2B platform. Each has a written data-protection agreement with SweetNote that flows down the obligations of the SweetNote DPA, including security measures, breach-notification windows, transfer mechanisms, and audit rights. Each subprocessor is engaged as a Service Provider under California Civil Code §1798.140(ag) (or as a Processor / Service Provider under analogous state law), contractually prohibited from selling or sharing Personal Information for any purpose other than the limited business purpose of providing the contracted service back to SweetNote.
| Provider | Role & data accessed | Region | DPA |
|---|---|---|---|
| Supabase supabase.com |
Managed Postgres database, authentication, file storage, and edge functions. Stores all Personal Data SweetNote processes for Customer (recipient PII, engagement events, Customer configuration, Customer-uploaded brand assets). Encrypted at rest (AES-256); encrypted in transit (TLS 1.2+). | United States | DPA |
| Netlify netlify.com |
Static hosting, edge functions, edge CDN, and SSL termination for the marketing site, brand-facing dashboard, and reveal page. Routes recipient and operator HTTP requests; does not retain recipient PII beyond standard request logs (7 days or less). | United States (global edge) | DPA |
| Mux mux.com |
Video hosting and adaptive streaming. Stores Customer-supplied video creative; serves it to recipients when a reveal page is opened (the video's still frame, from image.mux.com) and during playback (the video itself, from stream.mux.com). Receives no recipient names or engagement records; because a recipient’s browser fetches the still frame and stream directly, Mux receives the IP address and user agent that any web request carries. SweetNote has configured Mux so that no automated biometric analysis runs on Customer videos (face detection/recognition and voice-biometric identification disabled), and performs a quarterly internal configuration audit to confirm the disabled state. Mux's automated speech-to-text captioning is enabled for accessibility; it produces a text transcript only and derives no biometric identifier (see DPA §14.2). | United States | DPA |
| Postmark (an ActiveCampaign company) postmarkapp.com |
Transactional email delivery to Customer’s operators: sign-in links (Supabase Auth sends them through Postmark), team invites, study status and payment notices, subprocessor-change and policy notices, and DSAR acknowledgements. Processes the operator’s email address and the email content. SweetNote never emails recipients. Delivery logs are kept up to 45 days. | United States | DPA |
| Stripe stripe.com |
Payments and billing for Customer’s per-study fees and invoiced study charges. Processes Customer’s billing-contact Personal Data (name and email) and payment-method data. Does not access recipient Personal Data. | United States | DPA |
| Sentry (Functional Software, Inc.) sentry.io |
Application error monitoring and crash reporting on the brand portal and SweetNote’s server functions. Receives limited technical error data only (error type, message, stack trace, page path). SweetNote’s beforeSend scrubbing hook runs before any event leaves the browser or server: email addresses and access tokens are redacted, URL query strings are stripped, and request headers, cookies, and request bodies are never transmitted; no user-identity object is attached. The connection itself carries the standard technical metadata any web request does (IP address, user agent). The recipient-facing reveal page does not load Sentry at all. If a server function that serves the reveal fails, Sentry receives only the function name, request method and request path, with any query string removed. |
United States | DPA |
| Better Uptime betterstack.com/better-uptime |
Uptime monitoring and the public status page (status.thesweetnote.com, live from platform launch) used to measure the 99.0% Monthly Uptime Percentage SLA in MSA Exhibit A — listed here in advance per Section 3's notice practice. Monitors public endpoints by HTTP request; does not access tenant-scoped data or recipient PII. |
United States (global probes) | DPA |
Outcome Attribution · no new SweetNote subprocessors. When Customer enables the optional Outcome Attribution feature on a study, conversion events reach SweetNote from Customer's own systems (relaying Customer's payment processor: Stripe, Givebutter, Classy, Donorbox, or similar), or, where Customer connects its own cal.com account, directly from cal.com as a signed booking webhook. Those providers are Customer's subprocessors, not SweetNote's, Customer maintains the direct contractual relationship with each and is responsible for the relevant disclosures in Customer's own privacy notice. SweetNote ingests the four declared conversion fields (join key, value, currency, timestamp) via the
POST /v1/conversions endpoint and increments per-cell aggregates without persisting per-recipient amounts. The Stripe entry above describes SweetNote's own use of Stripe to collect Customer's per-study fees, a separate relationship from any Customer-initiated Stripe-as-conversion-source flow. Full details in the DPA Outcome Attribution Schedule.
Browser-loaded infrastructure (CDNs) · disclosed for completeness. Two content-delivery networks serve static assets (font files and pinned JavaScript libraries) directly to visitors' browsers: Google Fonts (fonts.googleapis.com / fonts.gstatic.com — typography on the public marketing site and the brand-facing portal) and jsDelivr (cdn.jsdelivr.net — pinned, integrity-checked copies of open-source libraries on brand-portal pages). These CDNs receive the standard technical metadata any web request carries (IP address, user agent); they process no recipient names, engagement events, or Customer data on SweetNote's behalf, and SweetNote sends them nothing server-side. They are listed here so this page covers every content-delivery network a visitor's browser contacts, not only contractual Data Processors. Neither CDN is contacted from the recipient-facing reveal page: its video player and its full brand-selectable font palette are both self-hosted on SweetNote's own origin, so no recipient IP address is ever disclosed to a CDN. The reveal page contacts only SweetNote’s own sub-processors: Mux, the Data Processor listed above (the video’s still frame from image.mux.com when the reveal opens, and the video stream from stream.mux.com only if the recipient presses play, each over a short-lived signed URL) and, if the brand set a logo, Supabase Storage. Mux is already listed above as a contracted Data Processor, so it is not an additional party — it is named again here because this callout's test is what a visitor's browser contacts, and a recipient's browser does contact it. It receives the technical metadata any video request carries, and no recipient name or engagement record.
2. What's deliberately not on this list
For procurement clarity, the following categories of providers are not used in the SweetNote pipeline.
- Automated biometric analysis (AWS Rekognition or comparable services), not invoked. Customer attests to AUP compliance in the MSA; no automated biometric analysis is applied to Customer-supplied videos.
- Automated content-moderation APIs (OpenAI Moderation or comparable services), not invoked for brand-supplied creative; brand-supplied creative is governed by the AUP.
- Web analytics vendors (Plausible, Google Analytics, Mixpanel, etc.), the SweetNote marketing site, reveal page, and dashboard load no third-party analytics scripts. Aggregate visitor counts are measured (when needed) only through server logs already covered above.
- Third-party identity-resolution / data-enrichment vendors: SweetNote does not enrich recipient data with demographic, firmographic, or behavioral inference from third-party providers.
- Cross-site advertising or tracking pixels: the reveal page and dashboard load no ad-tech vendor scripts, no Meta / Google / TikTok pixels, no LinkedIn Insight tag.
3. How changes work
SweetNote may change subprocessors as the platform scales (e.g., add a new region for hosting, swap a provider for performance or compliance reasons). Changes follow this process:
- 30-day notice. Customers receive written notice at the email on file at least 30 calendar days before a new subprocessor begins processing Customer Personal Data.
- Reasonable objection. Customer may object on reasonable data-protection grounds within the notice window; SweetNote and Customer will work in good faith to address the concern.
- If unresolved. Customer may terminate the affected service component and receive a pro-rated refund for the unused portion of pre-paid fees.
- Flow-down. Every new subprocessor is bound by a written DPA with terms no less protective than the SweetNote DPA before any processing begins.
4. International transfers
All subprocessors above operate in the United States (US-East default). SweetNote serves US-based Customers and US-resident recipients at launch; recipient PII does not transfer outside the United States in the ordinary course of providing the Services. International expansion (UK, EU, Canada, and other jurisdictions) is on the post-launch roadmap. When international support launches, SweetNote will publish the supporting transfer mechanisms (EU SCCs, UK IDTA, or equivalent) and the updated subprocessor list at that time. Edge networks operated by listed subprocessors (e.g., Netlify's edge, Supabase's edge functions) handle requests globally but do not retain recipient PII beyond transient request handling.
5. Contact
Subprocessor-related questions or notification preferences should be routed to legal@thesweetnote.com.