Sub-processor List

    Last updated: July 11, 2026

    GTM Heroes engages third-party sub-processors to deliver the Service. This page lists every sub-processor that processes customer or end-user personal data, the purpose of processing, the data categories involved, and the geographic location of processing. We notify customers of material changes to this list at least 30 days in advance. To receive sub-processor change notifications, email [email protected] with the subject line "Subscribe."

    Application infrastructure

    Lovable / Supabase

    Purpose: Application hosting, database, authentication
    Data: All customer-entered data including prospect records, drafted communications, uploaded transcripts, account credentials, usage telemetry
    Location: United States (AWS us-east-1)
    Privacy policy: https://supabase.com/privacy
    Data residency: US-only by default. EU residency available on enterprise request.

    Resend

    Purpose: Transactional email (authentication emails, product notifications)
    Data: User email addresses, authentication emails, notification content
    Location: United States
    Privacy policy: https://resend.com/legal/privacy-policy
    Effective: July 4, 2026

    AI model providers

    Anthropic (Claude API)

    Purpose: LLM inference for behavioral analysis, communication drafting, prospect research, call prep
    Data: Customer-provided prospect data, email content, transcripts, behavioral profiles
    Location: United States
    Privacy policy: https://www.anthropic.com/legal/privacy
    Training posture: Anthropic does not train models on API customer data. Standard 30-day retention for abuse monitoring; Zero Data Retention available for qualified customers on request.

    OpenAI

    Purpose: LLM inference for behavioral analysis and communication drafting where Claude is not the model in use
    Data: Same as Anthropic
    Location: United States
    Privacy policy: https://openai.com/policies/privacy-policy
    Training posture: OpenAI does not train models on API customer data by default. Standard 30-day retention for abuse monitoring; ZDR available on Enterprise tier.

    CRM and prospect data

    Apollo

    Purpose: Enrichment of prospect records synced or uploaded into the product
    Data: Customer prospect data: business contact information (name, title, company, email, phone) and publicly available professional profile data for prospects the customer synced or uploaded into GTM Heroes
    Location: United States
    Privacy policy: https://www.apollo.io/privacy-policy
    Retention: Contact data retained for the duration of customer's GTM Heroes subscription plus 90 days.

    HubSpot

    Purpose: CRM read-only integration for customer-side deduplication
    Data: Customer's CRM records that the customer chooses to surface to GTM Heroes (read-only)
    Location: United States
    Privacy policy: https://legal.hubspot.com/privacy-policy

    Payments

    Stripe

    Purpose: Payment processing for customer subscriptions
    Data: Billing contact information, payment method tokens (we do not store full card numbers)
    Location: United States
    Privacy policy: https://stripe.com/privacy
    PCI compliance: Stripe is PCI-DSS Level 1 certified. GTM Heroes does not handle or store cardholder data directly.

    Demo and buyer experience

    Supademo (GTM Heroes workspace)

    Purpose: Interactive demo assembly for GTM Heroes buyer rooms
    Data: Prospect name, company, and role used as demo personalization variables
    Location: United States
    Privacy policy: https://supademo.com/privacy-policy
    Note: This entry covers demos assembled in GTM Heroes' own Supademo workspace. Where a customer connects their own Supademo workspace, that is a customer-connected service governed by the customer's own agreement with Supademo, not a GTM Heroes sub-processor.

    Productivity and communication

    Google Workspace

    Purpose: Internal email, calendar, document storage for GTM Heroes team. Where customers connect a Gmail account to GTM Heroes for outreach drafting, Google's APIs are the access mechanism.
    Data: Email content (when customer connects Gmail), calendar metadata (when customer connects Calendar)
    Location: United States and EU per Google's standard architecture
    Privacy policy: https://policies.google.com/privacy

    Slack

    Purpose: Internal team communications. Some customer-facing Slack notifications when customers opt into a connected Slack workspace integration.
    Data: Notification payload content (when customer opts in)
    Location: United States
    Privacy policy: https://slack.com/trust/privacy/privacy-policy

    Data sourcing clarification

    GTM Heroes uses publicly available professional profile data to enrich prospect records. This enrichment is performed through our own data pipelines using authorized API and aggregated data partners; we do not engage third-party scrapers as sub-processors and we do not direct sub-processors to perform unauthorized data collection on our behalf.

    Contact