Subprocessor List

SMACKDAB SUB‑PROCESSOR LIST

Effective Date: November 22, 2025

Last Updated: November 22, 2025

Version:

1.0

Document Location: https://smackdab.ai/legal/sub-processors

---

INTRODUCTION

Smackdab Inc. (“Smackdab,” “we,” “us,” or “our”) engages certain third‑party service providers (“Sub‑Processors”) to support the delivery of our Services as defined in the Smackdab Terms of Service and Data Processing Addendum (“DPA”).

This page identifies the categories of Sub‑Processors we use, the services they provide, and their data processing locations. Capitalized terms not defined here have the meaning given in the DPA.

For more information about our data protection practices, please see:

• Smackdab Data Processing Addendum

• Smackdab Security Policy

• Smackdab Privacy Policy

---

HOW WE USE SUB‑PROCESSORS

We use Sub‑Processors to:

• Host and operate infrastructure and networking;

• Provide email, messaging, analytics, and support tooling;

• Deliver certain product features (e.g., telephony, file storage, AI); and

• Provide security, monitoring, and fraud‑prevention services.

Each Sub‑Processor is bound by a written agreement to maintain appropriate security, confidentiality, and data protection measures consistent with our DPA.

---

CURRENT SUB‑PROCESSORS

The table below identifies the third‑party Sub‑Processors currently engaged by Smackdab in connection with the Services.

Category

Sub‑Processor Name (Legal Entity)

Location(s) of Processing

Purpose / Services Provided

Cloud Infrastructure

Amazon Web Services, Inc. (“AWS”)

United States; other AWS regions as configured

Primary hosting of the Smackdab platform, including application servers, databases, networking, and related infrastructure.

Cloud Infrastructure

THE CONSTANT COMPANY, LLC d/b/a Vultr (“Vultr”)

United States; other Vultr regions as configured

Supplemental cloud infrastructure and compute resources supporting Smackdab services.

File Storage / CDN

Backblaze, Inc. (“Backblaze”)

United States (Backblaze B2 data centers)

Cloud object storage and backups for Smackdab data and system assets.

File Storage / CDN

Cloudflare, Inc. (“Cloudflare”)

Global edge network (including US and EU points of presence)

Content delivery network (CDN), DDoS protection, web application firewall, and performance optimization for Smackdab assets.

Email Delivery

Mailgun Technologies, Inc. (“Mailgun”), a Sinch Email company

United States; EU regions as configured

Transactional and notification email delivery from the Smackdab platform.

Telephony / SMS

Telnyx LLC (“Telnyx”)

United States; global carrier network

Voice, telephony, and SMS/MMS messaging services integrated into Smackdab.

Payments / Billing

Celero Commerce LLC (“Celero”)

United States

Payment card processing for Smackdab subscription and usage fees paid to Smackdab.

Payments / Billing

DBD Ventures LLC d/b/a Forward (“Forward”)

United States

Embedded payments platform used when Customers enable Smackdab’s integrated payments to charge their own customers.

Analytics / Monitoring

Functional Software, Inc. d/b/a Sentry (“Sentry”)

United States; other regions as configured

Application error tracking, performance monitoring, and log analytics that may include pseudonymous or user‑related data.

Analytics / Monitoring

Hotjar Ltd (“Hotjar”)

European Union (primarily EU data centers)

Product analytics, session recordings, heatmaps, and user feedback for Smackdab web and app experiences.

Analytics / Monitoring

Statsig, Inc. (“Statsig”)

United States; cloud infrastructure as configured

Feature flags and experimentation platform processing user identifiers and behavioral metrics.

Support & Product Adoption

Product Fruits s.r.o. (“Product Fruits”)

European Union (Czech Republic / EU data centers)

In‑app guides, onboarding tours, checklists, and product‑adoption flows for Smackdab users.

Email Hygiene / Validation

Hertza L.L.C. d/b/a ZeroBounce (“ZeroBounce”)

United States; additional regions as described in their DPA

Email verification, deliverability, and reputation checks on email addresses stored or used within Smackdab.

Email Hygiene / Validation

Apilayer Data Products GmbH (“apilayer”)

European Union (Austria / EU data centers)

Email validation and related data‑quality APIs used to validate customer email addresses.

Tax & Address Tools

Zip2Tax, LLC (service branded “Ziptax”)

United States

Sales‑tax rate lookup service using customer location and/or postal address data.

Tax & Address Tools

Google LLC (“Google”) – Google Maps Platform / Address APIs

Global (Google Cloud infrastructure, primarily US and EU)

Address validation, geocoding, and autocomplete for postal addresses used in Smackdab.

AI / ML Processing

Google LLC (“Google”) – Gemini AI services

Global (Google Cloud infrastructure, primarily US and EU)

Large Language Model (LLM) services used for AI‑powered Smackdab features (e.g., summaries, drafting, insights).

AI / ML Processing

Anthropic PBC (“Anthropic”)

United States; cloud infrastructure as configured

Large Language Model (LLM) services (Claude) used for AI‑powered features within Smackdab.

Voice / Meeting AI

Hyperdoc Inc d/b/a Recall.ai (“Recall.ai”)

United States; via integrated video‑conferencing platforms

Meeting bot and API that records, stores, and transcribes meetings and calls when users enable such features.

Voice / Meeting AI

Deepgram, Inc. (“Deepgram”)

United States; cloud infrastructure as configured

Speech recognition, transcription, and related voice‑AI processing for audio handled via Smackdab.

The list above is limited to third‑party providers that process Customer or end‑user personal data on behalf of Smackdab in connection with the Services. It does not include tools or services that are used solely for internal business operations or development (for example, source‑code security scanners that do not process Client Data) or self‑hosted components operated entirely by Smackdab.

---

CUSTOMER NOTIFICATION OF NEW SUB‑PROCESSORS

We will provide Customers with advance notice of any addition or replacement of Sub‑Processors as described in the DPA, typically via:

• Email notice to the account owner; or

• In‑app or dashboard notifications.

Customers may object to a new Sub‑Processor on reasonable data protection grounds as described in the DPA.

---

DATA TRANSFERS

Where a Sub‑Processor is located outside the EEA, UK, or other jurisdictions with applicable data transfer restrictions, Smackdab implements appropriate safeguards (such as Standard Contractual Clauses or equivalent mechanisms) as described in the DPA.

---

CHANGES TO THIS LIST

We may update this Sub‑Processor List from time to time. The “Last Updated” date above indicates the most recent change. For historical versions or questions, please contact us at privacy@smackdab.ai or as described in the DPA.