Subprocessors
Last updated: October 1, 2026
A subprocessor is a third-party service that we engage to process customer personal data on our behalf in order to provide the Qbox service. We enter into data-processing agreements with our subprocessors, where one has been executed, that require them to protect your data and to process it only as needed to provide their service to us — the transfer-safeguards column below states the current position for each subprocessor.
We will update this page at least 30 days before adding or replacing a subprocessor that processes customer personal data, and announce material changes in the app.
Current Subprocessors
| Subprocessor | Purpose | Personal data processed | Location | Transfer safeguards |
|---|---|---|---|---|
| Supabase (on AWS) | Database, authentication, file storage, serverless functions | All customer data stored in Qbox | United States | Provider DPA with SCCs |
| Vercel | Web application hosting | Request metadata | United States / global | Provider DPA with SCCs; EU-U.S. DPF certified |
| Gmail & Google Calendar APIs (user-authorized access); Gemini API for AI drafting and analysis (content not used for model training) | Mailbox and calendar content; AI-processed email content | United States | Provider DPA; EU-U.S. DPF certified; SCCs | |
| Microsoft | Outlook & Microsoft Graph APIs (user-authorized access) | Mailbox and calendar content | United States | Provider DPA; EU-U.S. DPF certified; SCCs |
| OpenAI | Primary AI generation for email drafts, LinkedIn replies, meeting content and relationship intelligence; text embeddings for search/matching; voice-input transcription; document text extraction (API data not used for model training) | Email text, thread history, meeting and calendar event details (titles, times, attendee names and email addresses), attendee profile details (job title, employer, public LinkedIn headline and role history), meeting-transcript excerpts, LinkedIn message excerpts, voice input (transient, not stored), uploaded knowledge-base documents | United States | SCCs (vendor DPA not yet executed) |
| Unipile | LinkedIn integration, and profile lookups for meeting attendees when you generate a pre-meeting brief | LinkedIn messages and profile data of accounts you connect, and the public profile identifier of a meeting attendee | France (EU) | Provider DPA |
| Stripe | Billing and payments | Email address; payment details are collected directly by Stripe | United States | Provider DPA; EU-U.S. DPF certified; SCCs |
| Resend | Transactional email delivery | Names and email addresses in team invitations and contact-form submissions | United States | Provider DPA with SCCs |
| Jina AI | Extracting text content from websites you ask us to import into your knowledge base, and fetching a meeting attendee's company homepage when you generate a pre-meeting brief | The URLs you submit and the fetched page content, and the company domain taken from a meeting attendee's email address | Germany (EU) | Provider DPA |
| Google Analytics & HubSpot | Analytics and visitor engagement on our public marketing website only (never loaded inside the application) | Website visitor and cookie data | United States | Provider terms |
Locations reflect each provider's primary region; providers may process data in additional regions as described in their own subprocessor disclosures. Where a provider is not certified under the EU-U.S. Data Privacy Framework, transfers rely on Standard Contractual Clauses.
Upcoming Subprocessors
The subprocessors below do not yet process customer personal data. Each may start no earlier than 30 days after its entry is first published on this page; the last column gives that earliest start date. If you object to an upcoming subprocessor, write to privacy@qbox-ai.com before that date.
| Subprocessor | Purpose | Personal data processed | Location | Transfer safeguards | Starts no earlier than |
|---|---|---|---|---|---|
| TypeSafe | AI classification and scoring: for example, whether an email needs a reply, how a LinkedIn conversation is going, how well a lead fits your ideal customer profile, or whether two contact records are the same person. It answers yes/no, multiple-choice and score questions only and generates no text (content not used for model training) | Excerpts of email threads and LinkedIn conversations, AI-drafted replies, knowledge-base excerpts used to check a draft's claims, and contact and lead details (names, job titles, companies, industries, locations). High-risk identifiers such as payment card and bank account numbers are removed before sending; names and email addresses are not | United States | Provider DPA with SCCs | November 4, 2026 |
Retention at TypeSafe: TypeSafe does not commit to a fixed deletion period for the content we send it. Under its terms it keeps that content for as long as necessary to provide its service, and it does not use it to train its models. See the AI Services section of our Privacy Policy.
For more information about how we handle your data, see our Privacy Policy.