Legal
Sub-processors
Last updated 27 October 2026
These are the third-party services we rely on to run CommunityTracker. Each one receives only what it needs to do its particular job. This page is referenced by our Privacy Policy.
Which of these can see your Google account data
If you have connected a Gmail or Outlook mailbox, this is the question that probably brought you here, so it goes first. Of the 29 providers listed below, exactly 4 can see data obtained from a connected mailbox:
- Supabase — Database, authentication and server-side functions. Hosted on AWS us-east-2 (Ohio, United States).
- Unipile — Brokers the connection to your Gmail or Outlook mailbox and holds the authorisation token. Sends the messages you approve and relays reply notifications back to us.
- OpenRouter — Routes each request to a model provider and enforces our requirement that the provider does not retain it. Which provider serves a given request is decided at the time of the request. For reply labels in your Inbox, it receives the text of a reply, the last message you sent that person and the start of the public post you found them through, each with addresses, phone numbers and links removed; it keeps nothing and does not train on it.
- Amazon Web Services, Google Cloud and Microsoft Azure — Operate the zero-retention endpoints that actually serve those models to us, including the one that labels the replies to your campaigns. They keep nothing and do not train on it.
No other provider on this page receives data from a connected Google account. In particular, our AI providers do not — outreach is drafted from the prospect’s public post, never from anything in your mailbox.
Where our own systems run
- Database — Amazon Web Services, us-east-2 (Ohio, United States), via Supabase
- Website and application — Vercel (global edge network)
- Community-monitoring automation — A dedicated server in Mumbai, India (Hostinger). Public posts only; no access to connected mailboxes.
Core infrastructure
Runs the product itself. Everything you store with us lives here.
| Provider | What it does for us | Google data? |
|---|---|---|
| Supabase | What it does for usDatabase, authentication and server-side functions. Hosted on AWS us-east-2 (Ohio, United States). | Google data?Yes |
| Vercel | What it does for usHosts this website and the web application. Serves the interface; your data is fetched by your browser directly from Supabase. | Google data?No |
| Hostinger | What it does for usA dedicated server in Mumbai, India running our automation engine for community monitoring. It has no access to connected mailboxes. | Google data?No |
Email sending and mailbox connection
Only used if you connect a mailbox for outreach.
| Provider | What it does for us | Google data? |
|---|---|---|
| Unipile | What it does for usBrokers the connection to your Gmail or Outlook mailbox and holds the authorisation token. Sends the messages you approve and relays reply notifications back to us. | Google data?Yes |
| Resend | What it does for usDelivers our own transactional email to you — sign-in links, reports and product notices. Never used for your outreach. | Google data?No |
AI processing
Used to score public posts, suggest keywords, draft outreach copy, label the replies to your campaigns, suggest how the columns of a lead list you upload match our fields and judge the leads you monitor. Every request is restricted to endpoints that do not retain it.
| Provider | What it does for us | Google data? |
|---|---|---|
| OpenRouter | What it does for usRoutes each request to a model provider and enforces our requirement that the provider does not retain it. Which provider serves a given request is decided at the time of the request. For reply labels in your Inbox, it receives the text of a reply, the last message you sent that person and the start of the public post you found them through, each with addresses, phone numbers and links removed; it keeps nothing and does not train on it. | Google data?Yes |
| Anthropic | What it does for usCreator of the Claude models we use to draft outreach and replies, write content briefs and update your company profile, and in parts of post scoring. | Google data?No |
| OpenAI | What it does for usCreator of the GPT models we use to suggest keywords, run the AI keyword advisor, score public posts and label the replies to your campaigns, and one of the models reply drafting falls back to if Claude is briefly unavailable. | Google data?No |
| DeepSeek | What it does for usCreator of the model that does the first pass of scoring public posts, and one of the models reply drafting falls back to if Claude is briefly unavailable. | Google data?No |
| TypeSafe | What it does for usCreator and operator of the model that suggests how the columns of a lead list you upload match our fields. The same model judges the leads you monitor. For column matching it receives the column names and up to three example rows, with email addresses and long numbers masked. For monitoring it receives your ideal customer profile and a lead’s job title and company. It also receives either the lead’s headline and industry, or the text of one public post from their profile or their company’s page. A company page’s post can be one it shared from someone else. Requests are restricted to endpoints that do not retain them. For monitoring, we use an answer only if TypeSafe itself served it. | Google data?No |
| Amazon Web Services, Google Cloud and Microsoft Azure | What it does for usOperate the zero-retention endpoints that actually serve those models to us, including the one that labels the replies to your campaigns. They keep nothing and do not train on it. | Google data?Yes |
Data sources and enrichment
Used to collect the public posts you monitor and data about the leads you monitor, and to find business contact details.
| Provider | What it does for us | Google data? |
|---|---|---|
| Apify | What it does for usCollects public posts from community platforms. For leads you monitor, it collects their public LinkedIn profiles and recent posts, and recent posts from their companies’ LinkedIn pages. Those can include posts a page shared from other people. It does this with scrapers that HarvestAPI publishes on Apify. The results also include details of other people that LinkedIn shows with a profile or a post, such as names and job titles. Apify keeps these results for about 31 days, then deletes them. | Google data?No |
| HarvestAPI | What it does for usPublishes the LinkedIn scrapers we run on Apify. These scrapers pass our requests to HarvestAPI’s own service, which collects the public LinkedIn data and sends it back. The requests hold the keywords of the LinkedIn searches you set up. For leads you monitor, they hold the addresses of their LinkedIn profiles and of their companies’ LinkedIn pages. HarvestAPI says it keeps its API logs for 30 days. | Google data?No |
| Exa | What it does for usWeb search and content retrieval for research features. | Google data?No |
| Icypeas | What it does for usFinds and verifies business email addresses. | Google data?No |
| Anymailfinder | What it does for usFinds and verifies business email addresses. | Google data?No |
| Prospeo | What it does for usFinds and verifies business email addresses, and finds business contact and company details for leads you upload or select: LinkedIn profile URLs, names and job titles, company details and mobile numbers. For leads you monitor, it provides company data (size, industry, country, funding and open job postings), looked up by the company’s LinkedIn page or website. | Google data?No |
Enrichment providers you connect yourself
Only used if you connect your own API key for one of these providers on the Integrations page. When you do, contact lookups for the leads you select are sent to that provider using your key, against your own account and your own credit balance — we are not billed and neither are your CommunityTracker credits. We send only what the lookup needs: the person’s name, their company name or website, and their public profile URL. Your own agreement with that provider governs what they do with it, including how long they keep it and what rights you have — ours does not apply, and we cannot make commitments on their behalf. Disconnecting the key on the Integrations page stops it immediately: nothing further is sent, and lookups fall back to our own providers listed above.
| Provider | What it does for you, on your account | Google data? |
|---|---|---|
| Prospeo | What it does for you, on your accountFinds business email addresses and mobile numbers on your own Prospeo account, when you connect your key. | Google data?No |
| Apollo | What it does for you, on your accountFinds business email addresses and mobile numbers on your own Apollo account, when you connect your key. We hold no Apollo account of our own. | Google data?No |
| Icypeas | What it does for you, on your accountFinds business email addresses on your own Icypeas account, when you connect your key. Requires the email address you sign in to Icypeas with, so the provider can identify the account. | Google data?No |
| Leadsforge | What it does for you, on your accountFinds business email addresses and mobile numbers on your own Leadsforge account, when you connect your key. We hold no Leadsforge account of our own. | Google data?No |
Business operations
Billing, support and understanding how the product is used.
| Provider | What it does for us | Google data? |
|---|---|---|
| Dodo Payments | What it does for usProcesses payments and manages subscriptions. Card details go to them directly and never reach our servers. | Google data?No |
| HubSpot | What it does for usCustomer records and the in-app support chat. | Google data?No |
| Microsoft Clarity | What it does for usAnonymised usage analytics and session replay inside the application, so we can see where the interface confuses people. Message content and contact details are masked before they leave your browser. Not used on this public website. | Google data?No |
| Google Analytics | What it does for usAggregate visitor statistics for this public website — which pages get read, and which sites people arrive from. Configured with Google’s advertising and cross-device tracking features switched off, so it does not feed remarketing audiences. Not used inside the application. | Google data?No |
| Ahrefs Analytics | What it does for usVisitor counts for this public website, used alongside our search-ranking tools. Cookieless, and not used inside the application. | Google data?No |
| Contentful | What it does for usStores the articles on our public blog. No customer data. | Google data?No |
| Calendly | What it does for usDemo and onboarding call scheduling, if you book one. | Google data?No |
| ipapi.co | What it does for usApproximate country lookup from IP address, used to show prices in a sensible currency. | Google data?No |
Changes to this list
We update this page when we add or remove a provider, and the date at the top reflects the current version. If you would like to be told in advance when the list changes, email support@communitytracker.ai and we will add you to the notification list.