Sub-processors
Last updated: 7 September 2026
Sonara Media AS engages the third-party service providers (“sub-processors”) below to help deliver our services. Each is bound by data processing terms compatible with the GDPR. Providers marked “customer-activated” only receive data when a customer enables that feature or connects their own account/API key — data flows to them at the customer’s direction.
Core infrastructure
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Supabase | Database & authentication | All customer & prospect data, account credentials | EU (Frankfurt) |
| Vercel | Application hosting & delivery | Application traffic, logs | USA |
| Upstash | Rate limiting (abuse & cost protection) | Rate-limit counters (org/IP identifiers) | EU / USA (region-selected) |
| Sentrycustomer-activated | Error monitoring | Diagnostic & error data | USA |
Communication
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Resend | Transactional & outbound email delivery | Email content, recipient address | USA |
| Google (Gmail & Calendar)customer-activated | Bring-your-own-mailbox send/reply sync & meeting booking | Email content, calendar events | USA / EU |
| Twiliocustomer-activated | SMS & WhatsApp messaging | Message content, phone number | USA |
AI processing
AI providers process prompt content to generate text. Customer Data is never used to train their models.
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| OpenAI | AI text generation, research synthesis, classification | Prompt content (message drafts, research inputs) | USA |
| Anthropic | AI text processing | Prompt content | USA |
Website analytics & advertising
Our public website only — never the platform. Nothing runs until a visitor accepts the cookie banner: Google Analytics loads in a consent-denied mode that stores nothing, and the Meta pixel is not loaded at all. Google’s advertising and personalisation features are disabled and IP addresses are anonymised.
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Google Analyticscustomer-activated | Public website traffic measurement | Page views, referrer, approximate location (anonymised IP) | USA / EU |
| Meta Platforms (pixel)customer-activated | Advertising measurement & audiences | Page views, referrer, IP address, browser identifiers | USA / EU |
| Leadfeedercustomer-activated | Identifying which companies visit the public website (trial) | Page views, referrer, IP address, browser identifiers | EU |
Payments
| Sub-processor | Purpose | Data processed | Location |
|---|
Data enrichment & research
Used only when the customer activates enrichment / deep research or connects their own API key. Data sent is limited to company identifiers (name, website, public LinkedIn URL) needed to look up publicly available business information.
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| BRREG (Brønnøysundregistrene)customer-activated | Norwegian company registry lookup | Company name / org. number | Norway (public data) |
| Apollocustomer-activated | Lead & contact discovery | Prospect name, company, domain | USA |
| Crunchbasecustomer-activated | Company & funding intelligence | Company name / domain | USA |
| BuiltWithcustomer-activated | Website technology detection | Company domain | USA |
| Serpercustomer-activated | Live web / news search | Company name (search query) | USA |
| Bright Datacustomer-activated | Public LinkedIn company data (followers, posts) | Company LinkedIn URL | USA / EU |
| Meta Platforms (Ad Library)customer-activated | Public advertising transparency data | Company name | USA / EU |
| Phantombustercustomer-activated | LinkedIn data collection | Public LinkedIn data | France (EU) |
| Google (PageSpeed)customer-activated | Website performance scoring | Public website URL | USA |
International transfers
Some sub-processors are located outside the European Economic Area (EEA), including the United States. Where personal data is transferred outside the EEA, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (SCCs) and supplementary measures where required.
Changes to this list
We will update this page when we add or replace a sub-processor. Customers may subscribe to change notifications by emailing fabian@sonara-media.com. We aim to notify customers of material changes before they take effect.
This list is provided for transparency and should be reviewed by qualified legal counsel as part of your data processing agreement. It does not constitute legal advice.