Legal

Sub-processors

These are the third-party providers that may process personal data on our behalf so we can run the service. Each one acts only on our instructions, under its own data processing agreement (DPA). We keep this list current and do not add providers without updating it.

A sub-processor is any company we use behind the scenes that may touch the information you share with us. We try to keep the list short on purpose. The fewer hands your data passes through, the easier it is to keep it safe, so we only bring on a provider when it is genuinely needed to run the service well, and we share only the minimum each one needs to do its job.

Before we add a provider, we check how it handles security and privacy, and we make sure there is a data processing agreement in place that holds it to the same standards we hold ourselves. Most of these providers operate in the United States, which means your information may be stored or processed there. If that ever changes, or if we add or remove a provider, we update this page first.

Last updated July 12, 2026

VercelWebsite hosting and content delivery, and where we generate the branded personalized review images (first name only, served through unguessable links) for Review System clientsUnited States

GoHighLevelCRM that stores your contact record and our conversation history, where we follow up on Operations Review and Review System requests, and — for Review System clients — where review requests are sent and new reviews are monitoredUnited States

Trigger.devMoves your form submission from the website into the CRMUnited States

OpenAIChat assistant — processes the messages you type into the site chat to generate replies (model gpt-4o-mini). Category: chat message contentUnited States

SupabaseApplication database — stores submission records and operational data (e.g. a reference to your CRM contact and timestamps) used to run the service and prevent duplicate processing, and stores Scorecard answers, qualification details and report context so a signed Operations Gap Report page can be regenerated on request. Category: contact reference, submission metadata, Scorecard answers and report inputsUnited States

You can ask us at any time to see, correct, or delete the personal information we hold about you, and that request flows through to these providers too. We follow Canada's PIPEDA rules for handling personal information, and we will never sell your data or share it with anyone outside this list for unrelated purposes. If you need a copy of a provider's DPA, or have a question about how your data is handled, see our Privacy Policy or email us at inbox@getphantom.io. We aim to answer privacy questions within a day or two.