Subprocessors and Data Recipients

A subprocessor processes Customer Personal Data for Foundable to deliver the Service. The table states the production path that uses each provider; an entry does not mean every customer uses every provider. Providers used only for Foundable's own analytics or internal operations, and third parties that determine their own purposes, are described separately after the table.

The location column identifies verified project regions or the provider's published processing footprint. It is not a promise that support, security, or subprocessor access can occur in only one country. Contact us if your procurement process requires the account-specific contracting entity, data-residency configuration, or transfer mechanism.

Claude is the primary model family for Ted's conversational reasoning and build agents. OpenAI and Cohere handle narrower embedding, extraction, transcription, and reranking tasks. fal.ai receives prompts or media only when creative generation is used. Each provider is limited to the feature scope and data categories listed in the table.

• Anthropic's commercial terms prohibit training on Customer Content submitted through its services. Its standard API retention is generally up to 30 days, with longer trust-and-safety or legal retention in documented cases. See its current retention documentation.
• OpenAI states that business/API data is not used to train models by default. Its endpoint-specific retention and abuse-monitoring rules are described in its data-control documentation.
• Agnost receives the projected conversation and tool data described in the table for product-quality analytics. Contact Foundable with account-specific contractual or data-handling requirements.

These vendors support Foundable's controller-side operations. They are not included in DPA Annex III when they do not process Customer Personal Data on a customer's behalf:

• Better Stack: public endpoint and job-heartbeat availability, status, latency, and incident metadata; it does not intentionally receive Customer Content.
• GitHub: Foundable source code and CI/CD. Customer-report metadata may appear when employees handle an issue, but product Customer Content is not intentionally stored there.
• Slack: Foundable's internal feedback and operational notifications. Feedback submitted to Foundable may be delivered to our internal Slack account.

Some features send data to a recipient that acts as an independent or joint controller, or has a role that varies by activity. Those recipients are not blanket Foundable subprocessors for that activity:

• Connected integrations and social networks receive the data and actions you direct Foundable to send. Their own terms govern their use of it.
• Meta Platforms, Inc. (Meta Ads), Google LLC (Google Ads, including YouTube ads), TikTok (TikTok For Business), and X Corp. (X Ads) may receive advertising-measurement data only when a visitor both arrives from that provider and explicitly allows ad measurement. Foundable uses no browser advertising pixels for this measurement; every provider receives only bounded server-side conversion measurement. The eligible data is an applicable provider click identifier (for Meta, a click identifier derived from fbclid and the first-party time when the ad landing was observed), event type, timestamp, provider-scoped pseudonymous stable event ID, the fixed event-source URL https://foundable.com/ for Meta, TikTok, and X, and an optional actual payment value/currency. The fixed URL has no path, query, or fragment and does not reveal the page viewed. Event type can include a successful refund or payment reversal as a distinct non-purchase event without payment value. Foundable's server payloads do not add the visitor's IP address, browser user agent, email, phone, actual page URL, referrer, provider browser cookie, idea/private-prompt text, form contents, account details, or Customer Content. GPC, DNT, no consent, or conflicting provider signals keep this measurement off. Each provider's own business, advertising, and privacy terms govern its use of received data.
• Meta for operator-approved Foundable Ads separately receives approved creative, campaign and delivery metadata, and eligible conversion events needed to deliver and measure an operator's approved advertising workflow under Meta's business and advertising terms.
• OpenSRS / Tucows, registry operators, ICANN, and escrow providers receive domain, registrant, contact, and transaction data required to register or administer a domain. Registry and legal retention may continue under their own obligations.
• Hunter acts for Foundable when verifying submitted contact data, but independently controls the professional Profile Data in its own database.
• Stripe and Link process some billing operations for Foundable and determine their own purposes for payment-network, fraud, compliance, tax, and merchant-of-record activities.
• Pexels / Canva Germany receives prompt-derived public-image search queries when the stock-photo rail is used.

We update this registry when a provider or its role changes. Where a countersigned DPA or applicable law requires advance notice, we use the notice method and period stated in that agreement or law.

To ask about a provider, request account-specific processing details, or raise a data-protection objection, email privacy@foundable.com. If an effective DPA gives you a formal objection right, its process and deadline control.

The public DPA page is available for review. Foundable and the customer complete an account-specific agreement to activate transfer mechanisms, audit rights, and notice periods.