Sub-processor List
Version 0.1, 9 November 2026.
Our solicitor is reviewing this document. Any change will be published here with a new version date.
Recon is a service of ALPN Digital Ltd (ALPN), a company registered in England and Wales with company number 17062799, whose registered office is at Gorsuch Place, Shoreditch Exchange, Senna Building, London, E2 8JF. Contact: hello@get-recon.com.
1. About this list
1.1 This list is Annex 4 to the Data Processing Agreement (the DPA), which forms part of the Agreement. Terms with capitals have the meaning given in the DPA or the Agreement.
1.2 The list has four sections:
(a) sub-processors that receive personal data;
(b) providers that receive no personal data from ALPN;
(c) the Customer's own tools, which the Customer contracts with directly; and
(d) planned sub-processors, which ALPN will not use until it has given notice.
1.3 ALPN will give the Customer at least 30 days' written notice before it adds or replaces a sub-processor, and the Customer may object, as set out in clause 7 of the DPA.
1.4 "Not yet confirmed" means ALPN has not yet confirmed that detail. ALPN will update this list once it has. A hosting region shown below is the region ALPN uses for that provider. It does not by itself mean that no Restricted Transfer takes place: some providers may be part of groups based outside the UK and the EU, and whether they can access data from elsewhere is not yet confirmed.
2. Section (a): sub-processors that receive personal data
2.1 Hosting, storage and analytics
| Sub-processor | Purpose | Personal data | Location | Transfer mechanism |
|---|---|---|---|---|
| Supabase | Main database, user sign-in, search over stored knowledge | All data held in the Service, including the Customer's users, contacts, prospects, replies and copy | eu-central-1 (Frankfurt, Germany) | Not yet confirmed |
| Render | Runs the computers behind the Service. This includes background jobs and n8n, a tool that runs automated steps, which ALPN runs on Render | Everything the Service processes behind the scenes, including prospect data passing through n8n | Frankfurt, Germany | Not yet confirmed |
| Vercel | Hosts the live portal (app.get-recon.com) and the get-recon.com website | Visitor and portal request data | Functions in fra1 (Frankfurt, Germany); other parts of the network not yet confirmed | Not yet confirmed |
| PostHog | Product and website analytics, error tracking, AI traces | Events, session recordings (typed input hidden), device data, approximate location, client identifier. Runs only with the visitor's consent. Whether AI prompt content is captured is not yet confirmed | EU host (eu.i.posthog.com) | Not yet confirmed |
2.2 AI
| Sub-processor | Purpose | Personal data | Location | Transfer mechanism |
|---|---|---|---|---|
| Anthropic | AI writing, quality checks, reply classification, prospect scoring, and the Ask Recon assistant | Prospect names, company research, reply text, copy written for the Customer | Not yet confirmed | Not yet confirmed |
| OpenRouter | Turns text into a searchable form so the Service can find past copy and notes. OpenRouter passes the text to an OpenAI model | Text turned into a searchable form, which may include names and message content | Not yet confirmed | Not yet confirmed |
2.3 Sending
| Sub-processor | Purpose | Personal data | Location | Transfer mechanism |
|---|---|---|---|---|
| Salesforge (Forge group: Salesforge, PrimeForge, WarmForge) | Sends email messages and follow-ups; provides mailboxes, sending domains and mailbox warm-up | Prospect name, email address and company; sent copy; replies | Not yet confirmed | Not yet confirmed |
2.4 Finding and checking prospects
| Sub-processor | Purpose | Personal data | Location | Transfer mechanism |
|---|---|---|---|---|
| Findymail | Finds and verifies work email addresses | Name with company domain, or LinkedIn profile URL, sent; email address returned | Not yet confirmed | Not yet confirmed |
| LeadMagic | Finds email addresses; people search | Name, company domain | Not yet confirmed | Not yet confirmed |
| MillionVerifier | Verifies email addresses | Candidate email addresses | Not yet confirmed | Not yet confirmed |
| Apollo (status not yet confirmed) | People and company search; email match | Search filters; name, job title, company | Not yet confirmed | Not yet confirmed |
| MoltSets | People search | Search filters; person records returned | Not yet confirmed | Not yet confirmed |
| Firecrawl | Reads company websites for research | Public web pages, which may name staff (classification not yet confirmed) | Not yet confirmed | Not yet confirmed |
| Apify | Business discovery from Google Maps listings | Public business listings, which may name sole traders (classification not yet confirmed) | Not yet confirmed | Not yet confirmed |
| Google (Places) | Business lookup | Business name and location, which may identify a sole trader (classification not yet confirmed) | Not yet confirmed | Not yet confirmed |
2.5 Booking, messages and internal operations
| Sub-processor | Purpose | Personal data | Location | Transfer mechanism |
|---|---|---|---|---|
| Google (sign-in, Calendar, Meet) | Sender signs in to Google to connect their calendar, so meetings can be booked into it | Sender email address, times when the person is free or busy, calendar events | Not yet confirmed | Not yet confirmed |
| Cal.com | ALPN's own "Book a call" page on get-recon.com; booking notifications received by the Service | Booker name, email address, notes | Not yet confirmed | Not yet confirmed |
| Resend | Transactional email: reports, alerts, onboarding | Recipient email addresses, report content | Not yet confirmed | Not yet confirmed |
| Slack | Internal approvals and alerts for ALPN's team | Draft copy, prospect names, reply excerpts | Not yet confirmed | Not yet confirmed |
| Linear | Internal tracking of alerts and product feedback | Error text, feedback text, name of the person who sent feedback | Not yet confirmed | Not yet confirmed |
| GitHub | Back-up tracking of alerts | Error text, which may contain personal data | Not yet confirmed | Not yet confirmed |
3. Section (b): providers that receive no personal data from ALPN
3.1 ALPN uses the providers below for lookups about companies. ALPN sends them company-level details only (a domain, a company name, a company number or search terms). Some return public information that can include names, such as officer names on the Companies House register. Where ALPN keeps that information, ALPN holds it as Prospect Data under clause 14 of the DPA.
| Provider | Purpose | What ALPN sends | Location |
|---|---|---|---|
| BuiltWith | Technology lookup | Company domain | Not yet confirmed |
| Google (PageSpeed) | Website speed signal | Company domain | Not yet confirmed |
| Ocean.io | Finding similar companies | Company domains | Not yet confirmed |
| PredictLeads | Company signals (jobs, news) | Company domain | Not yet confirmed |
| Adzuna | Job advert signals | Company names (job adverts returned may name a contact; classification not yet confirmed) | Not yet confirmed |
| Meta Ad Library | Public adverts lookup | Company names or search terms | Not yet confirmed |
| Companies House | UK company register | Company number (officer names returned from the public register) | UK |
4. Section (c): the Customer's own tools
4.1 The Customer may connect its own tools to the Service. The Customer is the vendor's customer and contracts with the vendor directly. ALPN connects to these tools only with the Customer's authorisation and uses them only on the Customer's instructions. They are not ALPN's sub-processors and are listed here for information.
| Tool | What the connection is used for |
|---|---|
| HubSpot | CRM: connected by the Customer through HubSpot's authorisation flow |
| Attio | CRM |
| Insightly | CRM |
| Zernio | The Customer's advertising accounts |
| JustCall | Phone: receives call event notifications from the Customer's JustCall account only |
4.2 CRM licences and other licences for these tools are not included in the Service.
5. Section (d): planned sub-processors
5.1 ALPN plans to use the providers below but does not use them yet. ALPN will give at least 30 days' notice under clause 7 of the DPA before it starts to use either of them for personal data.
| Provider | Planned purpose | Personal data expected |
|---|---|---|
| Revolut | ALPN may use this to collect payments in future. Today you pay by bank transfer on invoice. | Billing contact details (not yet confirmed) |
| Unipile | Sending email and LinkedIn messages, replacing Salesforge | Prospect name and contact details, sent copy, replies (not yet confirmed) |
6. Change log
6.1 2026-11-10: Google Analytics was removed from get-recon.com and app.get-recon.com. Google is no longer used for analytics. Google is still listed for sign-in, Calendar and Meet, and for business lookups.