Pulseri Sub-processors
Other companies help us run Pulseri. This page lists them in three groups: providers that process your data for us, providers for our own business, and tools you connect.
Last updated October 26, 2026
Providers that process Customer Personal Data
Customer Personal Data is personal data you put into Pulseri or collect through it, such as details of the people you survey and their answers. These sub-processors process it for us under our Data Processing Addendum (DPA).
Notice of changes
- We email account owners and update this page at least 30 days before a new or replacement provider starts processing Customer Personal Data.
- You can object within 30 days at [email protected] (see the DPA).
- To get notices at another address, write to the same inbox.
- In an emergency replacement we tell you as soon as we can, and you can still object.
| Provider | Legal entity | What it does | Data it receives | Where | Transfer safeguard |
|---|---|---|---|---|---|
| Google Cloud | Google Cloud EMEA Limited (Ireland); Google LLC (USA) for support access | Runs the Pulseri app, database, file storage, cache, secrets, monitoring and backups, and stores server logs. | All Customer Personal Data. | Belgium (EU); backups in Google's EU locations | Hosted in the EU. Google's data processing terms, with Standard Contractual Clauses for any access from outside the EU. |
| Cloudflare | Cloudflare, Inc. (USA) | Security, routing and content delivery for the app, the API and uploaded files. Hosts the dashboard and the widget script. | Decrypts and processes all traffic to the app and API, including People data, answers and comments, IP addresses and browser details. | Global network | Standard Contractual Clauses, or the EU-US Data Privacy Framework where the provider is certified. |
| Twilio SendGrid | Twilio Inc. (USA) | Sends survey and alert emails, keeps the list of addresses we must not email, and reports bounces and spam complaints. | Recipient name and email address, email content, alert content (scores and comments) and delivery events. | United States | Standard Contractual Clauses, or the EU-US Data Privacy Framework where the provider is certified. |
| Anthropic | Anthropic, PBC (USA) | AI tagging of sentiment and themes in comments, and weekly summaries. Its terms with us don't allow it to train its models on this data. | Comments (with email addresses and some phone number formats removed first), scores, and your organisation and campaign names. | United States | Standard Contractual Clauses. |
Providers we use for our own business
We use these for our website, billing, sign-in and our own email. Here we decide how the data is used, so our Privacy Policy covers them, not the DPA.
| Provider | Legal entity | What it does | Data it receives | Where | Transfer safeguard |
|---|---|---|---|---|---|
| Stripe | Stripe Payments Europe, Ltd. (Ireland) | Takes plan payments, sends invoices and receipts, checks VAT numbers and works out your tax location from the IP address used at sign-up. Stripe also acts as its own controller for fraud prevention. | Billing contact name and email address, billing address, VAT number, payment card details (entered directly with Stripe), sign-up IP address, and device details for fraud checks. | European Union and United States | Standard Contractual Clauses, or the EU-US Data Privacy Framework where the provider is certified. |
| Google reCAPTCHA | Google Ireland Limited (EEA and Switzerland); Google LLC (USA) elsewhere, including the UK | Bot protection on sign-in, sign-up and password reset in the app. Google acts as its own controller for this data. | IP address and browser and device signals. | United States | Standard Contractual Clauses, or the EU-US Data Privacy Framework where the provider is certified. |
| Google Analytics | Counts visits to this website. Where we ask for consent, it sets no cookies until you accept. | Pages visited, browser and device details, approximate location and analytics cookie identifiers. | European Union and United States | Standard Contractual Clauses, or the EU-US Data Privacy Framework where the provider is certified. | |
| Cloudflare (website) | Cloudflare, Inc. (USA) | Hosts this website, checks the contact form for spam with Turnstile, and looks up the visitor's country so the cookie banner knows whether to ask for consent (the country is not stored). | Website visitors' IP addresses and browser details, and contact form messages. | Global network | Standard Contractual Clauses, or the EU-US Data Privacy Framework where the provider is certified. |
| Twilio SendGrid (our own email) | Twilio Inc. (USA) | Sends our account emails to you and your team, such as invitations and password resets, and delivers contact form messages to our inbox. | Names and email addresses, email content and delivery events. | United States | Standard Contractual Clauses, or the EU-US Data Privacy Framework where the provider is certified. |
| Google and Microsoft sign-in | Google Ireland Limited (EEA and Switzerland) or Google LLC (USA); Microsoft Corporation (USA), with Microsoft Ireland Operations Limited for the EEA, UK and Switzerland | Lets you sign in with a Google or Microsoft account, only if you choose to. | The sign-in request. They send us your name, email address and account ID. | United States | Standard Contractual Clauses, or the EU-US Data Privacy Framework where the provider is certified. |
Tools you choose to connect
These are not our sub-processors. When you connect one, you tell us to send it data, and your own agreement with that provider applies.
Slack, Microsoft Teams, Zendesk, Stripe (as an event source), your own webhooks, your identity provider and directory, and AI assistants you connect.
More detail
The Data Processing Addendum explains how sub-processors are bound, how notice works and how to object.