Legal
Subprocessor List
Third parties that SparrowHawk CRM LLC engages to help operate the platform.
Effective: July 13, 2026
Last updated: July 13, 2026
- v1.0 · July 13, 2026Initial subprocessor register.
How to Read This List
SparrowHawk CRM LLC uses the subprocessors below to deliver the platform. Each is bound by contractual data-protection obligations consistent with the Data Processing Addendum and is chosen for security posture, published attestations, and operational reliability. The list is refreshed as subprocessors change.
Product names, service names, and trademarks referenced below belong to their respective owners. Nothing on this page implies endorsement by those parties.
Current Subprocessors
| Subprocessor | Purpose | Data Categories | Location |
|---|---|---|---|
| Supabase (managed Postgres + auth + storage) | Primary database, authentication, object storage, and realtime for the platform. | All Customer Data submitted to the platform. | United States (primary) |
| Cloudflare | Edge networking, DDoS mitigation, WAF, and TLS termination in front of the platform. | Request metadata (IP address, user agent, request path, response status). | Global edge; United States for origin traffic |
| Stripe | Payment processing, subscription billing, and Marketplace payouts. | Payment card and bank account data (handled by Stripe), buyer and vendor identity information, transaction metadata. | United States (primary) |
| Google (OAuth, Calendar) | Federated sign-in and Google Calendar synchronization when authorized by the Customer. | Profile data (name, email, avatar) and Calendar event data within scopes granted by the Customer. | Global (Google infrastructure) |
| QuickBooks (Intuit) | Accounting synchronization when authorized by the Customer. | Accounting entities (customers, invoices, payments, items, taxes) as authorized by the Customer. | United States |
| Twilio | Transactional SMS and voice where enabled by the Customer. | Recipient phone number, message content, delivery metadata. | United States (primary) |
| Email delivery provider | Transactional and notification email delivery. | Recipient email, message content, delivery metadata. | United States (primary) |
| AI provider(s) | Powering AI features described in the AI Usage Policy. | Prompts, selected account context, and AI responses required to render the feature. | United States (primary) |
New Subprocessors
SparrowHawk CRM LLC will use reasonable efforts to give advance notice of new subprocessors that will process Personal Data. Customers may object on reasonable data-protection grounds within thirty (30) days of notice as described in the Data Processing Addendum.
Contact
Subprocessor questions may be sent to privacy@sparrowhawkcrm.com (or support@sparrowhawkcrm.com if the privacy address is not yet monitored).