Effective Date: 8 May 2026 Last Updated: 8 May 2026
Canonical URL: apsalescoach.com/sub-processors. The legacy paths
/legal/subprocessorsand/legal/sub-processorspermanently redirect (HTTP 308) to this canonical address. This is the single source of truth for AP Sales Coach sub-processors.
This list identifies every third-party sub-processor that processes Personal Data on AP Leads' behalf in connection with the Service. We update it whenever we add or remove a sub-processor and we will notify customers at least 14 days in advance of any new sub-processor that materially changes how Personal Data is processed.
There are two distinct categories of third party in the AP Sales Coach data flow. Read both — the difference matters because it determines who the data controller is.
A. Operational sub-processors (AP Leads is the data controller)
These are services AP Leads Ltd uses on your behalf to deliver the Service. AP Leads is the data controller; the listed company is our processor under a Data Processing Agreement.
| Sub-processor | Service provided | Categories of data | Storage location | Transfer safeguard |
|---|---|---|---|---|
| Stripe Payments Europe Ltd (stripe.com) | Payment processing, customer portal, billing | Email, payment method, billing address, transaction history | EU + global | DPA + SCCs |
| Resend, Inc. (resend.com) | Transactional and lifecycle email delivery | Email address, email content, delivery metadata | United States / EU | SCCs + DPA |
| Supabase, Inc. (supabase.com) | Account, license, subscription, analytics storage | Email, hardware fingerprint hash, subscription records, usage events | Ireland (EU) | DPA + SCCs (EU host) |
| Sentry / Functional Software, Inc. (sentry.io) | Error monitoring and crash reporting (desktop app only — runs through a 5-layer redaction pipeline) | App version, OS version, error stack traces — no user content | United States | SCCs + DPA + redaction |
| Anthropic, PBC (anthropic.com) — Script Builder web feature ONLY | LLM-driven prose-to-script JSON conversion at apsalescoach.com/tools/script-builder. Runs server-side using AP Leads' own Anthropic API key. |
Prose text you submit + generated script JSON | United States | SCCs + DPA |
B. Distribution and infrastructure sub-processors
These touch metadata only (download counts, request logs, anonymous request metadata) but appear here for transparency.
| Sub-processor | Service provided | Categories of data | Storage location | Transfer safeguard |
|---|---|---|---|---|
| GitHub, Inc. (github.com) | Distribution of app updates and release artifacts | Anonymous download metadata | Global CDN | DPA |
| Vercel, Inc. (vercel.com) | Website hosting | Anonymous request logs, IP-derived country | Global edge network | DPA + SCCs |
| Cloudflare, Inc. (cloudflare.com) (where applicable) | DNS, edge protection | Anonymous request metadata | Global edge network | DPA + SCCs |
| Apple Inc. (apple.com) | macOS app distribution, code signing, notarization | Anonymous notarization metadata | United States | DPA + SCCs |
| Plausible Insights OÜ (plausible.io) | Privacy-first website analytics (no cookies, no fingerprinting, no personal data) | Aggregate page-view counts, anonymised event names, country-level geography | European Union (EU-hosted) | EU host (no transfer required) |
| Google LLC — Workspace (google.com) | Inbound and outbound email processing for @apsalescoach.com aliases |
Email address, email body content, attachments | EU + global | DPA + SCCs |
C. User-configured services (you are the data controller)
These services are NOT sub-processors of AP Leads Ltd. They run on API keys you supply yourself in the desktop app's Settings panel. Audio and transcript data flow directly from your Mac to these providers under your own account credentials. AP Leads has no DPA covering these flows because we are not a party to them — you are.
| Service | Used for (inside the desktop app) | Data flow | Where to read their privacy policy |
|---|---|---|---|
| Deepgram, Inc. (deepgram.com) | Real-time speech-to-text during live coaching | Audio: your Mac → Deepgram (your account, your key) | deepgram.com/privacy |
| Anthropic, PBC (anthropic.com) | Live script-node matching during coaching + the in-app "AI generate script" feature | Transcript text + script tree: your Mac → Anthropic (your account, your key) | anthropic.com/legal/privacy |
You are the data controller for these flows. AP Leads Ltd is not a party to your account with Deepgram or Anthropic. We do not see, route, store, or otherwise process the audio or transcripts that move between your Mac and those providers.
If you stop using AP Sales Coach, your data with Deepgram and Anthropic remains with those providers under your account — we cannot delete it on your behalf because we never had access to it. To revoke their processing of your data, log into your Deepgram and Anthropic accounts directly.
We strongly recommend reviewing both providers' privacy practices, retention settings, and any model-training opt-outs when you configure your keys in the app.
Important distinction. Anthropic appears in BOTH lists — but for completely separate flows:
- Section A (operational sub-processor): Anthropic, on AP Leads' Anthropic key, only for the Script Builder web feature at apsalescoach.com/tools/script-builder. AP Leads is data controller.
- Section C (user-configured): Anthropic, on your Anthropic key, inside the desktop app. You are data controller.
Same provider, two unrelated data-protection relationships. Don't conflate them.
D. Sub-processors we do not use
AP Leads deliberately does not use any third-party CRM, marketing-automation platform, customer-data platform, or session-replay tool. The marketing site ships zero session-replay scripts. The desktop application ships zero advertising SDKs.
E. Removed sub-processors (audit trail)
Once a sub-processor is removed from the stack we keep an entry here so the audit trail explains historical references in old data exports.
| Processor | Removed on | Reason | Last data flow |
|---|---|---|---|
| GoHighLevel | 2026-05-07 | Friction without value — Apple compliance simplification | No customer data ever processed through GHL in production path |
DPA register and breach notification
Internal record of executed Data Processing Agreements is maintained in our compliance file. Customers may request a redacted copy of any DPA covering their data via privacy@apsalescoach.com.
In the event of a personal data breach affecting customer data we control, we will notify affected customers within 72 hours of becoming aware (UK GDPR Article 33). This commitment does not extend to breaches in user-configured services (Section C) — those are governed by Deepgram's and Anthropic's own breach policies under your direct relationship with them.
Governed by the laws of England and Wales.