Subprocessors
Every third-party company that can process data on our behalf, what each one receives, and what it is used for.
Last updated: August 19, 2026
Running Booked55 means relying on other companies — to host the database, process payments, deliver email, and run the AI models behind our AI features. Each one is a subprocessor: it may handle data on our instructions, for a specific purpose, under a contract that requires it to protect that data and prohibits using it for its own purposes.
This page is the complete list. It is the detail behind Section 4 of our Privacy Policy, which governs in the event of any conflict.
We do not sell your personal information, and no company on this list receives your data for its own advertising or resale.
Infrastructure and storage
These providers hold the platform itself. Everything you store in Booked55 lives here.
| Provider | What it does | Data it receives | Processed in |
|---|---|---|---|
| MongoDB Atlas | Primary database — every CRM record you create | All account and CRM data: users, contacts, companies, deals, pipelines, activities, tasks, events, campaigns, email content, chat history | Canada |
| Akamai (Linode) | Application hosting and file storage | Application servers, and every file you upload — attachments, imports, exports, images | Canada |
- What it does
- Primary database — every CRM record you create
- Data it receives
- All account and CRM data: users, contacts, companies, deals, pipelines, activities, tasks, events, campaigns, email content, chat history
- Processed in
- Canada
- What it does
- Application hosting and file storage
- Data it receives
- Application servers, and every file you upload — attachments, imports, exports, images
- Processed in
- Canada
AI providers
When you use an AI feature, the data needed to answer that specific request is sent to one of these providers. They process it to return a result and, under our agreements with them, do not use it to train their models. If you would rather no data left our infrastructure for AI processing, do not use the AI features — they are never applied to your data automatically in the background.
| Provider | What it does | Data it receives | Processed in |
|---|---|---|---|
| Anthropic (Claude) | AI assistant conversations, reasoning, email drafting, pipeline coaching | Your chat messages and the CRM records relevant to the request you made | United States |
| Cerebras | Fast AI tasks — business-card scanning, chat titles, sub-agent tool calls | Card images you scan and the CRM records relevant to the request | United States |
| Google (Gemini) | Document and image understanding, structured data extraction | The file or record content for the request you made | United States |
| Perplexity | Web research for company search and contact enrichment | The search terms — typically a company or person name and domain | United States |
- What it does
- AI assistant conversations, reasoning, email drafting, pipeline coaching
- Data it receives
- Your chat messages and the CRM records relevant to the request you made
- Processed in
- United States
- What it does
- Fast AI tasks — business-card scanning, chat titles, sub-agent tool calls
- Data it receives
- Card images you scan and the CRM records relevant to the request
- Processed in
- United States
- What it does
- Document and image understanding, structured data extraction
- Data it receives
- The file or record content for the request you made
- Processed in
- United States
- What it does
- Web research for company search and contact enrichment
- Data it receives
- The search terms — typically a company or person name and domain
- Processed in
- United States
Email and calendar
Only active if you connect the integration. We hold an access token scoped to the permissions you granted and can disconnect it at any time from your settings.
| Provider | What it does | Data it receives | Processed in |
|---|---|---|---|
| Google (Gmail, Calendar) | Sending and syncing email, syncing calendar events | Messages and events in the mailbox or calendar you connected | United States |
| Microsoft (Outlook, Graph) | Sending and syncing email, syncing calendar events | Messages and events in the mailbox or calendar you connected | United States |
- What it does
- Sending and syncing email, syncing calendar events
- Data it receives
- Messages and events in the mailbox or calendar you connected
- Processed in
- United States
- What it does
- Sending and syncing email, syncing calendar events
- Data it receives
- Messages and events in the mailbox or calendar you connected
- Processed in
- United States
Payments
| Provider | What it does | Data it receives | Processed in |
|---|---|---|---|
| Stripe | Subscription billing and payment processing | Billing name, email, address, and card details. Card numbers are entered directly with Stripe and never reach our servers. | United States |
- What it does
- Subscription billing and payment processing
- Data it receives
- Billing name, email, address, and card details. Card numbers are entered directly with Stripe and never reach our servers.
- Processed in
- United States
Analytics and monitoring
These tell us how the product is used and when it breaks. They do not receive your CRM records as such, but error reports and session recordings can incidentally contain data that was on screen when something went wrong.
| Provider | What it does | Data it receives | Processed in |
|---|---|---|---|
| PostHog | Product analytics and session recording inside the app | Pages viewed, features used, clicks, session recordings (password fields masked), and your account ID and email when logged in | United States |
| Sentry | Error and performance monitoring | Stack traces, request metadata, user and organization IDs. Authorization headers, cookies, API keys, passwords and tokens are stripped before sending. | United States |
- What it does
- Product analytics and session recording inside the app
- Data it receives
- Pages viewed, features used, clicks, session recordings (password fields masked), and your account ID and email when logged in
- Processed in
- United States
- What it does
- Error and performance monitoring
- Data it receives
- Stack traces, request metadata, user and organization IDs. Authorization headers, cookies, API keys, passwords and tokens are stripped before sending.
- Processed in
- United States
Changes to this list
We update this page when we add or remove a subprocessor. If you have a written agreement with us that requires advance notice of new subprocessors, we will give you that notice as agreed. To be notified of changes, or to ask a question about any provider listed here, email [email protected].
See also: Privacy Policy · Security · Terms of Service