CX-SignalsSub-processors
Last updated: 2 November 2026
CX-Signals ("we") uses the third-party service providers listed below ("sub-processors") to provide the CX-Signals service. A sub-processor may process data that our customers give us or that the service creates for them ("customer data"). This includes personal data, as described in our Data Processing Addendum and Privacy Policy.
Each sub-processor receives only the data it needs for the purpose shown. Each one processes that data under a written agreement with data protection terms.
Sub-processors
| Sub-processor | Purpose | Customer data processed | Location | Data protection terms |
|---|---|---|---|---|
| Anthropic, PBC | AI model provider. Analyses public news about the organizations a customer tracks and writes the signals and talking points shown in the product. | Names and website addresses of tracked organizations, their competitors and industry. Text of public articles about them, which can include names of people mentioned in the news. The product description a customer enters. Not sent: user names, email addresses, account details. | United States | Anthropic Data Processing Addendum, part of Anthropic's Commercial Terms. Anthropic states that it deletes API inputs and outputs within 30 days, with limited exceptions, and that it does not train models on customer content. |
| Exa Labs, Inc. | Web search. Finds public news and web pages about tracked organizations. | Search queries made from tracked organization names and alternative names, industry terms, competitor names and general topic words. The website address a customer enters when setting up their product description. Tracked organizations' public website addresses. Not sent: user names, email addresses, account details, the customer's product description. On standard plans, Exa uses anonymised data to improve its models. | United States | Exa Data Processing Addendum, part of Exa's Terms of Service. Includes the EU Standard Contractual Clauses and the UK Addendum. |
| Supabase Pte. Ltd. | Database hosting. | All customer data stored in the service: users' names and email addresses, workspace membership, tracked organizations and settings, signals and talking points, ratings, usage and billing records. | Singapore (AWS ap-southeast-1) | Supabase Data Processing Addendum. |
| Railway Corporation | Hosting of the CX-Signals application server and scheduled jobs. | All customer data while the application processes it, plus application logs. | United States (US West, California) | Railway Data Processing Addendum. |
| Cloudflare, Inc. | Hosting and delivery of the CX-Signals website and web application files. Domain name services. Cookieless visit analytics for the website only (Cloudflare Web Analytics). | Visitors' IP addresses, browser information and request logs; for website analytics, pages viewed, referring site, browser and device type and country. | Global network | Cloudflare Customer Data Processing Addendum, part of Cloudflare's Self-Serve Subscription Agreement. |
| Okta, Inc. (Auth0) | User sign-in. | Users' email addresses, sign-in events, IP addresses, browser and device information. | United States | Okta Customer Data Processing Addendum. |
| Plus Five Five, Inc. (Resend) | Sending email: sign-in codes (our sign-in provider sends them through Resend), workspace invitations, weekly digests, account-setup reminders, balance, credit-expiry and account notices, notices of changes to our terms and sub-processors, notifications to us of website form submissions, and internal service alerts to us (for example a report about a signal, or a database outage). | Recipients' email addresses and names, and email content (for example signals, tracked organization names, balance information, the address a workspace administrator invites, and the details people enter in our website forms). | United States | Resend Data Processing Addendum. It takes effect when a customer accepts Resend's Terms of Service. |
| Functional Software, Inc. (Sentry) | Error monitoring for the CX-Signals application server and web application. | Technical error reports. These can incidentally contain data from the request that failed. From the web application: the error, the browser and device type, and the page address without its query string. CX-Signals configures Sentry not to collect users' IP addresses or identities, or the text of the browser console. | European Union | Sentry Data Processing Addendum. |
| Google LLC (Google Workspace) | Company email: support requests, replies to account emails, notifications of website form submissions, and our internal service alerts. | Names, email addresses and message content of people who write to us. Our internal service alerts, which identify workspaces and accounts by name and number. | Not fixed: Google does not commit to a storage location for this data without a data-region setting. | Google Cloud Data Processing Addendum. |
Payment provider
Purchases of CX-Signals credits are processed by Paddle (Paddle.com Inc. for buyers in the United States, Paddle.com (Canada) Ltd. for buyers in Canada, and Paddle.com Market Limited, England and Wales, for buyers everywhere else), which acts as the merchant of record. When you buy credits, you buy from Paddle, and Paddle processes your payment and billing details under its own privacy notice. Paddle shares with us the details of your purchases and the name, email address and billing address you gave Paddle, so that we can credit your workspace and support your purchase. We do not receive or store your full card details.
Changes to this list
We will update this page before we add or replace a sub-processor. We will email the administrators of every workspace at least 30 days before the change takes effect. If you have a reasonable data protection objection to a new sub-processor, email support@cx-signals.com within 14 days of the notice. The process is described in our Data Processing Addendum.