Legal

Sub-processors

This page lists the third-party providers (sub-processors) that may process customer data on behalf of FlexInbox, as referred to in the Data Processing Agreement (DPA) annexed to the FlexInbox User Service Agreement. Providers marked optional process data only when the customer enables the related feature. We notify customers a reasonable time before a new sub-processor begins processing customer data; the current list is always this page.

Last updated: 23 September 2026

1. Infrastructure and security

Provider	Purpose	Data and location
Hetzner Online GmbH	Application and database hosting; encrypted offsite backups (Storage Box)	All service data; Germany (EU). Backups encrypted with rclone crypt; secrets and session material additionally encrypted to an offline key
Cloudflare, Inc.	DNS; third backup copy (R2 object storage)	DNS proxy is off (no traffic inspection). Backups in R2 EU jurisdiction, encrypted with rclone crypt
Functional Software, Inc. (Sentry)	Error and stability monitoring	Error events only; e-mail addresses, phone numbers, request bodies and secrets are masked before transmission. Performance tracing is disabled
Resend, Inc.	Transactional e-mail (verification codes, password reset, billing and service notices)	Recipient address, subject and message body of the notice

2. Messaging channels and CRM (selected by the customer)

Provider	Purpose	Data and location
Zernio (Meta Business Solution Provider) — optional	Official WhatsApp Business Platform, Instagram and Messenger connections; Meta Lead Ads and Conversions API	Message content, contact identifiers, lead form and conversion event data; only for the channels the customer connects
Meta Platforms (WhatsApp, Instagram, Messenger)	Message delivery	Subject to Meta's own terms; connected by the customer
Telegram FZ-LLC — optional	Telegram channel connection	Message content and the customer's Telegram session; only when the Telegram channel is connected
Zoho Corporation · Bitrix Inc. · HubSpot, Inc. · HighLevel Inc. (GoHighLevel)	CRM integration selected by the customer	Contact, lead and deal records and message synchronisation; each under its own terms

3. Artificial intelligence (optional)

Provider	Purpose	Data and location
OpenAI, L.L.C.	AI agent responses; image description (vision); voice-note transcription (Whisper); knowledge-base processing	Only when the customer enables the AI agent: the relevant message text, images or audio and the customer's knowledge-base text. Not used to train general-purpose models

4. Billing

Provider	Purpose	Data and location
Paddle.com Market Ltd.	Merchant of Record: payment, subscription management, tax and invoicing	Payment and billing data; card data never reaches FlexInbox servers. Paddle may act as an independent data controller for the payment transaction

5. Promotional website only

Provider	Purpose	Data and location
Google LLC (Google Analytics)	Visit statistics on flexinbox.io	Loaded only after the visitor accepts analytics cookies. Does not process customer messages or panel usage

6. Changes to this list

When we intend to add or replace a sub-processor that will process customer data, we update this page and notify customers through the panel or by e-mail a reasonable time in advance. Customers may object on legitimate data-protection grounds as described in the DPA. Questions: support@flexinbox.io.