Subprocessors
The third parties that process customer data on our behalf, what each one actually receives, and where it is held. This list is part of the Data Processing Addendum.
Infrastructure
Engaged for every customer — the product does not run without them.
| Provider | Purpose | Data received | Location |
|---|---|---|---|
| Supabase | Primary database, authentication and file storage | All customer data: contacts, publications, photographs, sign-in identities | United States (AWS us-west-1) |
| Railway | Application and background-worker hosting | All customer data in transit and in process memory | United States |
| Cloudflare | DNS, encrypted off-site backups (R2), inbound email routing | Encrypted database backups and stored files; inbound mail | United States |
| Resend (Amazon SES) | Outbound email — invitations, reminders, upload links | Recipient name and email address, message contents | United States (us-east-1) |
| Stripe | Subscription billing | Billing contact and payment details. Card numbers go directly to Stripe and are never stored by Circulr | United States |
| WorkOS | Authentication for the assistant (MCP) connection | Email address and sign-in events for users who connect an assistant | United States |
| Google Cloud | Google sign-in, and geocoding of addresses you enter | Email address for sign-in; addresses submitted for geocoding | United States |
Artificial intelligence
Engaged only for publications that have the relevant feature switched on. A publication with AI research and semantic search turned off sends nothing to any of these.
| Provider | Purpose | Data received | Location |
|---|---|---|---|
| Anthropic | Research summaries, content extraction, and matching the columns of a file you import (Claude) | Publicly available web pages about the people you track and the text of your own articles, when AI research is enabled; and, when AI import assistance is enabled, the column headings of a file you import together with up to three example values from each column — which for a contact list are real names, email addresses or phone numbers. Never the whole file. When Circulr’s own agents are switched on (Settings → AI): the week’s activity figures for the Monday brief; the names, email addresses and employers of the records in a data-review item the data steward cannot settle by rule, and the title of a notebook it cannot match by rule (a name as it was typed) with the names, employers and interview dates of the people it might be — never the notebook’s pages — and the name of a photo folder it cannot match by rule, with the names and employers of the people it might be; and the names, issue and dates in a follow-up email the coordinator agent drafts for you to approve; and, for a renewal letter or an overdue-invoice note the sponsorships agent drafts for you to approve, the sponsor’s name, their contact’s first name, their level, term end date, the invoice amount and month, and counts from their year (issues with their ad, features, events their people came to); and, for the thank-you after an event they sponsored, the event’s name and date and counts only (how many came, how many were Top 500 agents, how many were their own people, how many photos) — never an attendee’s name, never an email address; and, once per interview, the interview’s transcript, read only for the businesses the realtor recommends — what comes back is each business, its kind and the realtor’s own words about it, and nothing else from the transcript is kept. When ranking proof reading is on (Settings → AI; on unless you turn it off): the screenshots and PDFs a realtor attaches to the production numbers they send for a ranked list, read for the figures, the agent’s name and the period they cover (spreadsheets are read by Circulr itself and never sent). When the in-product assistant is on (a paid add-on, switched on per publication): the questions a person asks it and the records it reads to answer them, within that person’s role — contact details only for roles that may already see them; and, for its memory, a nightly summary of each contact, company, event and sponsorship made from your records, research profiles and interview summaries, with contact details removed and never transcripts or notebook pages. | United States |
| OpenAI | Text embeddings, which power semantic search | Article text, interview transcripts, and the research profiles written about the people you track (their biography, facts and tags), the assistant’s memory summaries of your contacts, companies, events and sponsorships (when the assistant is on), and the words of a search you run — when semantic search is on (Settings → AI; on unless you turn it off) | United States |
| Brave | Web search used to find public sources during research | Search queries containing a person or company name | United States |
Member app
Engaged for the people in a publication who install the Circulr member app and allow notifications. Nothing reaches Apple for a person who has not.
| Provider | Purpose | Data received | Location |
|---|---|---|---|
| Apple | Push notifications to the iOS member app | The device token and the notification’s title and text — a person’s or event’s name as the notification reads it — for members who installed the app and allowed notifications | United States |
Text messages
Engaged only for a publication that has registered texting, and only for people who opted in to texts. Nothing reaches Twilio for anyone else.
| Provider | Purpose | Data received | Location |
|---|---|---|---|
| Twilio | Text messages — reminders and links to the people a publication features, once that publication has registered texting | The recipient’s mobile number and first name and the message text, for people who opted in to texts; replies sent back to those texts | United States |
Integrations
Engaged only when a publisher connects their own account. Data flows between Circulr and a service the publisher already uses, under credentials they supply and can remove.
| Provider | Purpose | Data received | Location |
|---|---|---|---|
| Google Sheets | Importing a master list you maintain in a spreadsheet | The contents of the sheet you share with us | United States |
| Eventbrite | Importing your events and guest lists | Event and attendee records from your own Eventbrite account | United States |
| Intuit QuickBooks | Reconciling sponsor payments against your books | Customers and money transactions (invoices, payments, receipts, deposits) read from your own QuickBooks company — read only; contact details are not kept | United States |
| Gmail and Google Calendar | Showing the emails and meetings you have with the people in your sales pipeline on each of them | Read from the Google account a staff member connects, read only: the emails exchanged with, and the calendar events that include, the people in the sales pipeline — sender, recipients, subject and text of each email; title, time, place, description and attendees of each event. Nothing else in the mailbox or calendar is kept. To find them, Circulr sends Google those people’s email addresses as a search. Deleted from Circulr when the account is disconnected | United States |
| Plaud | Fetching interview recordings and transcripts you have made | Recording metadata and transcripts from your own Plaud account | United States |
| Google Drive | Fetching photographs from a Google Drive share link a photographer sends you | The link itself (a file or folder id) when Circulr downloads from it. The files travel from Google to Circulr; nothing of yours is sent to Google | United States |
Changes to this list
We will give at least 30 days' notice before a new subprocessor starts handling customer data, by email to workspace owners. If you object on reasonable data-protection grounds within that window, write to privacy@circulr.io and we will work to address it or you may terminate the affected service.