Legal
Sub-processors
The third parties that process personal data for us when we run MagpieCRM Cloud. Self-hosted MagpieCRM uses none of them unless you set them up yourself.
Last updated 27 September 2026
| Sub-processor | What they do for us | Personal data involved | Location | Transfer safeguard |
|---|---|---|---|---|
| Contabo GmbH | Hosts each customer's copy of MagpieCRM and its data | Everything stored in the customer's account | Germany (EU) | Within the EU |
| OVH SAS | Servers our email verification connects from | Email addresses being checked, and the company mail servers they belong to | France (EU) | Within the EU |
| SocialFetch [legal entity to be confirmed] | Company and people data behind prospect search | Search terms (job titles, companies, keywords) and the professional profile details returned: name, job title, seniority, company, country, profile URL | [to be confirmed] | [to be confirmed] |
| Amazon Web Services EMEA SARL | Sends customers' email, and reports bounces and spam complaints back | Recipient email addresses, message content, delivery, bounce and complaint events | United Kingdom (London region) | Within the UK |
| [Backup storage provider to be confirmed] | Encrypted nightly backups | Everything stored in the customer's account, encrypted before it leaves our servers | [EU or UK region to be confirmed] | [to be confirmed] |
| Kinde [legal entity to be confirmed] | Sign-in to MagpieCRM Cloud | Account holders' names, email addresses and sign-in records | United Kingdom (London data region) | Stored in the UK [confirm Kinde's support access and its own sub-processors] |
Not sub-processors
- Stripe takes payment for your subscription. That's our own billing, covered by our privacy policy; it never sees your contacts.
- Anthropic and OpenAI: the in-app copilot runs on your own API key, so they act for you, not for us. If you use the copilot, list them in your own privacy notice.
- Cloudflare runs our DNS and hosts our website. Your workspace's traffic doesn't pass through it.
Changes
We tell customers about a new or replacement sub-processor at least 30 days before it starts processing their data, and they can object, as set out in our data processing agreement.