Current Sub-Processors
We require every Sub-processor to be under a data protection agreement meeting GDPR Article 28, and we remain responsible to you for what they do. Where data goes outside the EEA, the safeguards are set out in Section 14 of our Terms.
Messaging
WhatsApp Business API and Cloud API, Instagram Graph API, Messenger
WhatsApp Business API delivery and phone number provisioning. SMS is delivered through your own connected Twilio account, where Twilio is not our Sub-processor
Email channel delivery through our own system account, sent from Mailgun's EU region. Where you connect your own Mailgun or SMTP credentials, delivery runs on your account and Mailgun is not our Sub-processor for that traffic
Lifecycle and product email to account holders — your own account email address and subscription events, not your contacts' data
AI
Primary large language model provider
Gemini for voice note transcription, image and video understanding; Calendar and Drive OAuth; Places API for business lookup in Find Leads
Whisper transcription of phone call recordings and voicemail. API data is not used to train OpenAI's models; abuse-monitoring logs are retained up to 30 days
Text embeddings for FAQ retrieval, covering both stored FAQ content and inbound message text used as the search query
Payments
Payment processing
Infrastructure
EU dedicated server hosting — our application, database and WhatsApp Web service
CDN, DNS and network protection in front of our websites and API. Traffic passes through Cloudflare in transit. Also provides cookie-free aggregate traffic-source measurement for our public website
Specific Cloud Functions in EU regions
Authentication and file storage in EU regions
Integrations
Third-party integration framework for Custom Functions
Fetches public web pages for knowledge base and FAQ import, and for prospect research in Find Leads
Restaurant reservation integration — receives a contact's name, email and phone to create or cancel a booking
Restaurant reservation integration — receives a contact's name, email and phone to create or cancel a booking
Connectivity
Residential and ISP proxies that improve WhatsApp Web connection reliability
Diagnostics
Application error and performance monitoring for our web dashboard. Diagnostic data only, IP anonymised, no session recording. Data is ingested and stored in the EU region; the entity is US-based
Get Notified of Changes
Add your email and we'll tell you 14 days before any new Sub-processor starts handling your data. Nothing else — this list is only ever used for these notices, and you can unsubscribe from any of them.
How Changes Work
You gave us general authorisation to use Sub-processors when you accepted our Terms, so we don't need a new signature each time this list changes. What we owe you instead is notice and a say.
Before a new Sub-processor begins processing your data, we tell you at least 14 days ahead, by email or in-app notice and by publishing it on this page. If you object on reasonable data-protection grounds, we'll work with you to find a commercially reasonable solution. If we can't find one within 30 days, you can terminate the affected Services without penalty.
This is set out in full in Section 14 of our Terms of Service, which is also our Data Processing Agreement. If you need a counter-signed copy for a compliance review, you can download one here.
Reach our team at hi@dmchamp.com and we will respond within two business days.