Legal
Sub-processors
The third parties that process personal data for us when we run MagpieCRM Cloud. Self-hosted MagpieCRM uses none of them unless you set them up yourself.
Last updated 8 November 2026
| Sub-processor | What they do for us | Personal data involved | Location | Transfer safeguard |
|---|---|---|---|---|
| Contabo GmbH | Hosts each customer's copy of MagpieCRM and its data, and the crawler and web search we run for prospect search, and keeps daily backups off the server for 10 days | Everything stored in the customer's account, and prospect search terms and results while a search runs | Germany (EU) | Within the EU |
| OVH Limited | Hosts our mail server, which sends customers' email and receives bounces and spam complaints, and the servers our email verification connects from | Recipient email addresses, message content, and delivery, bounce and complaint events; email addresses being checked, and the company mail servers they belong to | United Kingdom (London) | Within the UK |
| NodeMaven FZ-LLC (NodeMaven) | Two services. Its Scraping Browser, a Chrome browser NodeMaven hosts for us, runs our Google and DuckDuckGo searches for people by job title. Its residential proxy carries all our requests for LinkedIn's public company and profile pages | Scraping Browser: search terms (job titles, locations, industries, company names) and the search result pages, which list people's names, job titles, employers, locations and profile addresses, readable by NodeMaven because it runs the browser. NodeMaven doesn't say whether it records sessions or what a saved browser profile keeps. Proxy: encrypted connections to LinkedIn, so NodeMaven sees the site and how much data moved, not which page was read or what it said | United Arab Emirates (Ras Al Khaimah). NodeMaven doesn't publish where its browsers run or where data is kept | None yet: NodeMaven publishes no data processing agreement or transfer safeguard. We're arranging one with it |
| Kinde Australia Pty Ltd | Sign-in to MagpieCRM Cloud | Account holders' names, email addresses and sign-in records | Stored in the United Kingdom (London data region); Kinde's support is based in Australia | Stored in the UK; any access from Australia is covered by Kinde's data processing agreement |
| SourceIT Technologies, Inc. (Mailivery) | Runs the warmup pool for inbox warmup, only for senders a customer switches it on for: it sends each one's warmup through our mail server, and signs in to the sender's inbox to find the warmup mail it receives, reply to some of it and file it in a folder; it also runs a monthly sender check: one test email from each warming sender, to see where it lands | For each sender warming: its email address, name and inbox login, and the warmup emails it exchanges with other mailboxes in the pool (who sent them, their subjects and message identifiers, and where they landed). The login gives access to the whole inbox; Mailivery reads only the warmup mail in it. It keeps the data as its data processing agreement sets out, and names its own sub-processors on request | United States (SourceIT Technologies, Inc., Illinois), where it processes and stores the data | Mailivery's data processing agreement, with the EU Standard Contractual Clauses as amended by the UK International Data Transfer Addendum |
| Anthropic Ireland, Limited (Anthropic) | Runs Maggy, the in-app copilot, through Anthropic's Claude API: it reads each chat, with what the copilot's tools look up to answer it, and writes the reply | What the customer types to the copilot, and what its tools read for that chat: contacts, lists, campaigns, surveys and prospect search results, which can include people's names, email addresses, job titles and employers. Anthropic deletes API inputs and outputs within 30 days unless one is flagged under its usage policy, and doesn't train its models on them | Anthropic Ireland, Limited contracts with us; Anthropic stores the data in the United States, and may process a request in the US, Europe, Asia or Australia | Anthropic's data processing agreement, part of its Commercial Terms, with the EU Standard Contractual Clauses and the UK International Data Transfer Addendum |
Our crawler and web search run on our own servers at Contabo. NodeMaven isn't told which customer a search or page read is for.
Not sub-processors
- Stripe takes payment for your subscription. That's our own billing, covered by our privacy policy; it never sees your contacts.
- OpenAI, and Anthropic on your own key: where the in-app copilot runs on your own API key, as in self-hosted MagpieCRM, they act for you, not for us. If you use it that way, list them in your own privacy notice.
- Cloudflare runs our DNS and hosts our website. Your workspace's traffic doesn't pass through it.
- PostHog runs our website analytics, in its EU cloud. It isn't in your workspace or the customer portal, so it never sees your contacts, prospects, emails or campaigns. That's covered by our privacy policy.
Changes
We tell customers about a new or replacement sub-processor at least 30 days before it starts processing their data, and they can object, as set out in our data processing agreement.