Sub-processors
Postfjord uses a few other companies to run the service. This page lists every one of them that can receive personal data: what it does for us, which data it gets and where. It is the same list as Annex 3 of our Data Processing Agreement and section 5 of our Privacy Policy.
Sub-processors for your workspace's data
These companies handle data about your contacts for you, under our Data Processing Agreement. Each one is bound by data processing terms that protect the data at least as well as ours do.
| Company | What it does for Postfjord | Which data | Where |
|---|---|---|---|
| Google Cloud and Firebase Data processing terms | Hosting, database, file storage and servers for every feature. Checks the links in your emails against Google Web Risk before they are sent. | Everything in your workspace: contacts, messages, comments, emails, files and settings. For Web Risk, only the links. | EU (Belgium, europe-west1) |
| Amazon Web Services (Amazon SES) GDPR and data processing | Sends your emails and tells us which were delivered, bounced or marked as spam. | Each email and the address it goes to, and the delivery, bounce and complaint events. | EU (Stockholm, Sweden) |
| Anthropic Privacy policy | Postfjord's AI: AI replies and AI drafts, the writing assistant, the brand profile and the weekly plan, when your workspace uses Postfjord's AI and not its own provider. Also scores the posts Mentions finds. | The text the AI works on, such as the last messages of a conversation and the person's display name. For Mentions, the post text and your brand description, never the author's handle or picture. No access tokens. | USA (EU standard contractual clauses) |
| OpenAI Data processing addendum | Turns speech into text: a brief you dictate, and the sound of a video when your workspace makes video pages. Not used when your workspace uses its own ChatGPT key. | The recording or the video's sound, which can contain voices and names. We do not store the recording. | USA (EU standard contractual clauses) |
| Oderland Privacy policy | Sends notification emails to your team. | A contact's name, a short piece of a message or an email address a form collected, when the notification is about them. | Sweden |
| Cloudflare Data processing addendum | Delivers your landing pages and link in bio pages on postfjord.page, with the signup forms on them. | A visitor's request with their IP address, and what they type in a form. | Global (EU-US Data Privacy Framework and EU standard contractual clauses) |
| Google Fonts Privacy and Google Fonts | Serves the web fonts in your emails. When an email uses one of them, the reader's mail app fetches the font from Google. | The reader's IP address and mail app details, sent by their mail app when it loads the font. | Global (EU-US Data Privacy Framework) |
Providers we use for our own accounts and websites
These companies handle data about you as our customer, or about visitors to our own websites. Postfjord is the controller for that data, as our Privacy Policy says. They never get your contacts' data, so they are not sub-processors under the Data Processing Agreement.
| Company | What it does for Postfjord | Which data | Where |
|---|---|---|---|
| Google Cloud and Firebase Privacy and Firebase | Sign-in to Postfjord, and the network that delivers the app and postfjord.com. | Your name, email address and sign-in details. Firebase stores your password only in scrambled form. | Global |
| Stripe Data processing agreement | Payments and subscriptions for your Postfjord plan. | Your card details, name, billing address and VAT number if you give one. Card details never reach us. | EU and USA (EU-US Data Privacy Framework and EU standard contractual clauses) |
| Oderland Privacy policy | Sends our service emails to you, such as sign-in codes, password resets and invitations. | Your email address and the email. | Sweden |
| Google reCAPTCHA Enterprise Google Privacy Policy | Checks that requests to the app come from a person in a real browser. You never solve a puzzle. | Your IP address, browser details and how the page is used. | Global (EU-US Data Privacy Framework) |
| Google Fonts Privacy and Google Fonts | Fonts in the app at app.postfjord.com. postfjord.com serves its own fonts. | Your IP address, when your browser loads the fonts. | Global (EU-US Data Privacy Framework) |
| Google Analytics Google Privacy Policy | Visitor statistics on postfjord.com, only after you accept cookies. | Which pages you read and how you found them, with a cookie id. | EU and USA (EU-US Data Privacy Framework and EU standard contractual clauses) |
| Cloudflare public DNS (1.1.1.1) Privacy policy | The free SPF and DMARC checker on postfjord.com: your browser asks Cloudflare for the records of the domain you type. | That domain name and your IP address. | Global (EU-US Data Privacy Framework and EU standard contractual clauses) |
| Postmark (ActiveCampaign) Data processing addendum | Reads the daily DMARC reports that mail providers send about email sent in postfjord.com's name, so we can see if someone tries to send as us. | The addresses of the servers that sent the email, how many emails and whether they passed the checks. No email content and no contacts. | USA (EU-US Data Privacy Framework and EU standard contractual clauses) |
Services you connect yourself
Platforms and services you connect to Postfjord yourself, such as Meta, TikTok, LinkedIn, YouTube, Shopify, Mailchimp, Calendly, Slack, Telegram or your own AI provider, are not our sub-processors. They act under your own agreement with them, as section 5 of our Privacy Policy explains.
When this list changes
Before we add or replace a sub-processor that will handle your workspace's data, we tell the workspace owner at least 30 days ahead, by email or in the app. We then update this page and Annex 3 of the Data Processing Agreement. If you have a reasonable data protection objection, tell us within those 30 days at hello [at] postfjord.com. If we cannot solve it, you may stop using the feature it affects or end your subscription without penalty. That is section 5 of the Data Processing Agreement.
When a provider we use for our own accounts and websites changes, we update the Privacy Policy and this page, and change the date at the top.