Bossreach · Terms of Service · Privacy Policy · Data Processing Addendum · Subprocessors · Acceptable Use Policy
Bossreach Subprocessors
Last updated: October 11, 2026. These are the companies that may process data for Bossreach and its customers. We give 30 days' notice of a new subprocessor (see the DPA, Section 7). To hear about changes, email privacy@bossreach.io with the subject "Subprocessor updates".
>
Core infrastructure (always used)
| Subprocessor | Purpose | Data | Location |
|---|---|---|---|
| Cloudflare, Inc. | Hosting (Workers), storage (KV, R2, D1, Durable Objects, Queues), email routing and sending, image handling, browser rendering for crawling, web analytics on some sites | All customer data at rest and in transit; visitor IP and request data | Global edge network; US |
| Google LLC (Google Cloud / Firebase) | Sign-in (Firebase Authentication), databases (Firestore, Cloud SQL), BigQuery reporting, optional customer-hosted deployments (Cloud Run, Cloud Storage), Google Fonts | Account emails and names; CRM and campaign data; reports | US |
| Supabase, Inc. | Postgres database for some organisations | CRM contacts and campaign data | US |
Email delivery and verification (per organisation; customer chooses)
| Subprocessor | Purpose | Data |
|---|---|---|
| Brevo (Sendinblue SAS) | Sending email | Recipient email, name, message content, delivery events |
| Resend, Inc. | Sending email | Same |
| Twilio SendGrid | Sending email | Same |
| Postmark (ActiveCampaign) | Sending email | Same |
| EmailOctopus | Newsletter sending | Subscriber email, name |
| ZeroBounce, Bouncer | Checking an email address is deliverable | Email address |
Data enrichment and research (optional, customer turns on)
| Subprocessor | Purpose | Data sent |
|---|---|---|
| Hunter.io, Apollo.io, People Data Labs | Finding or confirming business contact details | Company domain, person name |
| Exa, Brave Search, Firecrawl | Web search and crawling public business websites | Search queries, URLs |
| Google Places, YouTube Data, Search Console, Analytics Data API | Business listings, video stats, site reports | Business names, site IDs |
Artificial intelligence (optional features)
| Subprocessor | Purpose | Data sent | Training |
|---|---|---|---|
| Anthropic, PBC | Drafting emails, classifying replies and support emails, summarising | Contact names, company, website text, email and reply content | Not used for training under commercial API terms |
| Google (Gemini API) | Images, audio transcription of call recordings, drafting | Prompts; call audio and transcripts where the customer turns on call analysis | Paid API: not used for training. The free tier may be, so customer keys must be on a paid plan |
| OpenRouter, Inc. (routing to the selected model provider) | Model access | Prompts as above | Routed to the selected model's provider under that provider's API terms |
Integrations (only when a customer connects them)
Salesforce, HubSpot, Copper, Calendly, RingCentral, Twilio, PostGrid (postal mail), RobinReach, Bluesky, Twitch, Reddit Ads, PostHog, Slack, Discord, Notion, Switchy, Payload / WordPress / Webflow / Sanity, Gmail / Google Sheets / Google Drive APIs. Data sent: what the integration needs to sync (contacts, messages, events).
Not used
No payment processor (no Stripe or similar). No advertising networks receive customer data.
Changes log
| Date | Change |
|---|---|
| October 11, 2026 | OpenRouter row: training column reworded. |
| October 9, 2026 | First published list. |
Bossreach is operated by Final Boss Games · [mailing address] · privacy@bossreach.io