Who else touches your data, what reaches them, and where. Named, not described in categories.
Effective 8 October 2026 · Last updated 8 October 2026
A sub-processor is a third party that handles personal information on our behalf so we can provide the Service. This page names every one of them, because “trusted service providers” is not an answer to the question. It supports Privacy Policy §6 and §7, and is part of our Terms of Service.
These are involved in every workspace. The Service cannot be delivered without them.
| Who | What they do for us | What reaches them | Where |
|---|---|---|---|
| MondoTalk | Carries SMS to Australian networks. | Recipient number, sender ID and the text of the message. | Australia |
| Twilio Twilio Inc. |
Carries SMS and MMS, provisions dedicated numbers, and answers number lookups. | Recipient number, sender ID, the text of the message, any picture sent, and the number being looked up. | United States |
| Vultr The Constant Company, LLC |
Runs the application and the database. | Everything the Service holds, at rest and in use. | Australia |
| Cloudflare Cloudflare, Inc. |
DNS, the encrypted tunnel that publishes the app, our website hosting, and Email Routing, which receives email-to-SMS messages. | All traffic in transit, including request addresses; the content of any email you send to an email-to-SMS address. | Global edge network, nearest point of presence |
| Stripe Stripe Payments Australia Pty Ltd and Stripe, Inc. |
Takes card payments and issues receipts. | Billing name, email address and card details. Card numbers go directly from your browser to Stripe and are never stored on our systems. | Australia and United States |
| Twilio SendGrid | Sends our own email: address confirmation, password resets, invoices and alerts. | Your email address and name, and the content of those messages. | United States |
Configured by us for the whole platform rather than per workspace.
| Who | What they do for us | What reaches them | Where |
|---|---|---|---|
| OpenAI OpenAI, L.L.C. |
Powers AI drafting in the composer and the AI assistant that drafts replies. | Only the text being drafted or replied to, and the knowledge-base content you chose to give the assistant. Not your contact list, and not your message history. | United States |
| Sentry Functional Software, Inc. |
Reports application errors so we find faults before you report them. | Diagnostic data: the error, where in the code it happened, and the request address. Message content is not sent. | United States |
Neither of these uses your data to train AI models, and we do not either — see Privacy Policy §10.
Nothing here is involved until someone in your workspace connects it. Disconnecting stops the exchange.
| Who | What they do | What reaches them | Where |
|---|---|---|---|
| An AI assistant you connect ChatGPT, Claude or any other MCP client |
Reads and, if you permit it, sends through your workspace on your behalf. | Exactly the permissions you approved, and nothing else. An assistant starts able to read without seeing message text, cannot send, and can never reach billing, your team or your API keys. | Set by that provider, not by us |
| Xero Xero Limited |
Accounting integration: invoice and contact sync. | Contact names and phone numbers, and invoice details, for the records you sync. | Australia, New Zealand and United States |
| Shopify Shopify Inc. |
E-commerce integration: order and customer events. | Customer names, phone numbers and order details for the events you subscribe to. | United States and Canada |
| Microsoft Microsoft Corporation — Entra ID |
Single sign-on, if your organisation uses it. | Your name, email address and your organisation's directory identifier. | Set by your own Microsoft tenant |
An assistant you connect is the one entry here where data leaves our platform into a system you chose and we do not control. That provider's terms govern what happens to it inside their service, not ours. Read them before connecting, and see Privacy Policy §10.
| Who | What they do | What reaches them | Where |
|---|---|---|---|
| Plausible Analytics Plausible Insights OÜ |
Counts page views on sms365.com.au, without cookies and without identifying anyone. | Page address, referrer, and coarse device type. No cookies, no profile, nothing personal. | European Union |
| Google Google LLC — Tag Manager and Analytics |
Website analytics, only if you agree to analytics cookies. | Nothing at all unless you consent. If you do: page views and the cookies described in our Cookie Policy §4. | United States |
| Google Fonts Google LLC |
Serves the typeface used on our website and in the console. | Your request address, when your browser fetches the font file. | United States |
Pages a message recipient lands on — an unsubscribe link, or a link shortened through us — carry none of this. No analytics, no tag manager, no advertising. See Cookie Policy §7.
This page is the current list. When we add or replace a sub-processor that handles personal information, we update it here, and the “last updated” date changes with it. If you would like to be told in advance rather than finding out here, email [email protected] and we will add you to the notification list.
Questions about anything on this page go to our Privacy Officer — see Privacy Policy §17.