Sub-processors
These are the third-party providers that may process personal data on our behalf so we can run the service. Each one acts only on our instructions, under its own data processing agreement (DPA). We keep this list current and do not add providers without updating it.
A sub-processor is any company we use behind the scenes that may touch the information you share with us. We try to keep the list short on purpose. The fewer hands your data passes through, the easier it is to keep it safe, so we only bring on a provider when it is genuinely needed to run the service well, and we share only the minimum each one needs to do its job.
Before we add a provider, we check how it handles security and privacy, and we make sure there is a data processing agreement in place that holds it to the same standards we hold ourselves. Most of these providers operate in the United States, which means your information may be stored or processed there. If that ever changes, or if we add or remove a provider, we update this page first.
| Provider | What it does | Location |
|---|---|---|
| Vercel | Website hosting and content delivery | United States |
| Supabase | Application database — stores a copy of each form submission (name, email and, if given, phone, website, Google Business Profile link, where you think you lose customers and a note, plus the page it came from and how you reached the site) and operational data for the services we run for clients | United States |
| Ahrefs | Website analytics: counts visits and where they came from, without cookies | Singapore |
| Resend | Sends your form submission to us by email | United States |
| Telegram | Delivers a copy of your form submission to our phone | United Arab Emirates |
| Google (Ads API) | For clients whose advertising we run: reads campaign performance and reports conversions from the client's own forms and calls, as described in the privacy policy | United States |
You can ask us at any time to see, correct, or delete the personal information we hold about you, and that request flows through to these providers too. We follow Canada's PIPEDA rules for handling personal information, and we will never sell your data or share it with anyone outside this list for unrelated purposes. If you need a copy of a provider's DPA, or have a question about how your data is handled, see our Privacy Policy or email us at inbox@getphantom.io. We aim to answer privacy questions within a day or two.