Legal
Sub-processors
Last updated: May 26, 2026
EngagementAmp uses the following trusted third-party service providers ("sub-processors") to provide the Service. Each sub-processor is contractually bound by a Data Processing Addendum (DPA) and may only use personal data for the limited purpose of providing their service to us.
We notify customers of material changes to this list at least 30 days before they take effect. To receive notifications, email support@engagementamp.com with the subject "Sub-processor notifications."
| Sub-processor | Purpose | Data processed | Location | DPA |
|---|---|---|---|---|
| Vercel, Inc. | Application hosting, serverless compute, edge network, request logs | IP address, request metadata, log data, any data passed through the Service | United States (with global edge network) | vercel.com/legal/dpa |
| Supabase, Inc. | Primary database, authentication, file storage | Customer account info, hashed credentials, application data including encrypted OAuth refresh tokens | United States / European Union (region configurable) | supabase.com/legal/dpa |
| Google LLC | OAuth identity (Google Analytics, Google Search Console) — read-only access to metrics for the property you authorize | Google account email, OAuth refresh token, metrics retrieved from your connected GA / GSC property | United States / European Union | business.safety.google/processorterms |
| Resend, Inc. | Transactional email delivery (password setup, account notices, reports) | Recipient email address, email content, delivery metadata | United States | resend.com/legal/dpa |
| Notion Labs, Inc. | Internal content and operations backend that powers parts of the dashboard | Client onboarding content, campaign assets, internal notes | United States | notion.so/legal/data-processing-addendum |
| Formagrid, Inc. (Airtable) | Operational source-of-record for certain account and campaign data | Account identifiers and campaign records used to run the service | United States | airtable.com/company/dpa |
What about your data?
For a description of the categories of personal data we collect and how we handle it, see our Privacy Policy. To exercise your privacy rights, visit Your Privacy Rights.
Customer DPA
Customers can review and execute our Data Processing Addendum, which incorporates the sub-processor list on this page by reference.
Objecting to a sub-processor
If you object to a new sub-processor we add, you may terminate the Service with respect to the affected processing within 30 days of our notice. See Section 8 of the DPA for full detail.