Sub-processor List

Version 0.1, 9 November 2026.

Our solicitor is reviewing this document. Any change will be published here with a new version date.

Recon is a service of ALPN Digital Ltd (ALPN), a company registered in England and Wales with company number 17062799, whose registered office is at Gorsuch Place, Shoreditch Exchange, Senna Building, London, E2 8JF. Contact: hello@get-recon.com.

1. About this list

1.1 This list is Annex 4 to the Data Processing Agreement (the DPA), which forms part of the Agreement. Terms with capitals have the meaning given in the DPA or the Agreement.

1.2 The list has four sections:

(a) sub-processors that receive personal data;

(b) providers that receive no personal data from ALPN;

(c) the Customer's own tools, which the Customer contracts with directly; and

(d) planned sub-processors, which ALPN will not use until it has given notice.

1.3 ALPN will give the Customer at least 30 days' written notice before it adds or replaces a sub-processor, and the Customer may object, as set out in clause 7 of the DPA.

1.4 "Not yet confirmed" means ALPN has not yet confirmed that detail. ALPN will update this list once it has. A hosting region shown below is the region ALPN uses for that provider. It does not by itself mean that no Restricted Transfer takes place: some providers may be part of groups based outside the UK and the EU, and whether they can access data from elsewhere is not yet confirmed.


2. Section (a): sub-processors that receive personal data

2.1 Hosting, storage and analytics

Sub-processorPurposePersonal dataLocationTransfer mechanism
SupabaseMain database, user sign-in, search over stored knowledgeAll data held in the Service, including the Customer's users, contacts, prospects, replies and copyeu-central-1 (Frankfurt, Germany)Not yet confirmed
RenderRuns the computers behind the Service. This includes background jobs and n8n, a tool that runs automated steps, which ALPN runs on RenderEverything the Service processes behind the scenes, including prospect data passing through n8nFrankfurt, GermanyNot yet confirmed
VercelHosts the live portal (app.get-recon.com) and the get-recon.com websiteVisitor and portal request dataFunctions in fra1 (Frankfurt, Germany); other parts of the network not yet confirmedNot yet confirmed
PostHogProduct and website analytics, error tracking, AI tracesEvents, session recordings (typed input hidden), device data, approximate location, client identifier. Runs only with the visitor's consent. Whether AI prompt content is captured is not yet confirmedEU host (eu.i.posthog.com)Not yet confirmed

2.2 AI

Sub-processorPurposePersonal dataLocationTransfer mechanism
AnthropicAI writing, quality checks, reply classification, prospect scoring, and the Ask Recon assistantProspect names, company research, reply text, copy written for the CustomerNot yet confirmedNot yet confirmed
OpenRouterTurns text into a searchable form so the Service can find past copy and notes. OpenRouter passes the text to an OpenAI modelText turned into a searchable form, which may include names and message contentNot yet confirmedNot yet confirmed

2.3 Sending

Sub-processorPurposePersonal dataLocationTransfer mechanism
Salesforge (Forge group: Salesforge, PrimeForge, WarmForge)Sends email messages and follow-ups; provides mailboxes, sending domains and mailbox warm-upProspect name, email address and company; sent copy; repliesNot yet confirmedNot yet confirmed

2.4 Finding and checking prospects

Sub-processorPurposePersonal dataLocationTransfer mechanism
FindymailFinds and verifies work email addressesName with company domain, or LinkedIn profile URL, sent; email address returnedNot yet confirmedNot yet confirmed
LeadMagicFinds email addresses; people searchName, company domainNot yet confirmedNot yet confirmed
MillionVerifierVerifies email addressesCandidate email addressesNot yet confirmedNot yet confirmed
Apollo (status not yet confirmed)People and company search; email matchSearch filters; name, job title, companyNot yet confirmedNot yet confirmed
MoltSetsPeople searchSearch filters; person records returnedNot yet confirmedNot yet confirmed
FirecrawlReads company websites for researchPublic web pages, which may name staff (classification not yet confirmed)Not yet confirmedNot yet confirmed
ApifyBusiness discovery from Google Maps listingsPublic business listings, which may name sole traders (classification not yet confirmed)Not yet confirmedNot yet confirmed
Google (Places)Business lookupBusiness name and location, which may identify a sole trader (classification not yet confirmed)Not yet confirmedNot yet confirmed

2.5 Booking, messages and internal operations

Sub-processorPurposePersonal dataLocationTransfer mechanism
Google (sign-in, Calendar, Meet)Sender signs in to Google to connect their calendar, so meetings can be booked into itSender email address, times when the person is free or busy, calendar eventsNot yet confirmedNot yet confirmed
Cal.comALPN's own "Book a call" page on get-recon.com; booking notifications received by the ServiceBooker name, email address, notesNot yet confirmedNot yet confirmed
ResendTransactional email: reports, alerts, onboardingRecipient email addresses, report contentNot yet confirmedNot yet confirmed
SlackInternal approvals and alerts for ALPN's teamDraft copy, prospect names, reply excerptsNot yet confirmedNot yet confirmed
LinearInternal tracking of alerts and product feedbackError text, feedback text, name of the person who sent feedbackNot yet confirmedNot yet confirmed
GitHubBack-up tracking of alertsError text, which may contain personal dataNot yet confirmedNot yet confirmed

3. Section (b): providers that receive no personal data from ALPN

3.1 ALPN uses the providers below for lookups about companies. ALPN sends them company-level details only (a domain, a company name, a company number or search terms). Some return public information that can include names, such as officer names on the Companies House register. Where ALPN keeps that information, ALPN holds it as Prospect Data under clause 14 of the DPA.

ProviderPurposeWhat ALPN sendsLocation
BuiltWithTechnology lookupCompany domainNot yet confirmed
Google (PageSpeed)Website speed signalCompany domainNot yet confirmed
Ocean.ioFinding similar companiesCompany domainsNot yet confirmed
PredictLeadsCompany signals (jobs, news)Company domainNot yet confirmed
AdzunaJob advert signalsCompany names (job adverts returned may name a contact; classification not yet confirmed)Not yet confirmed
Meta Ad LibraryPublic adverts lookupCompany names or search termsNot yet confirmed
Companies HouseUK company registerCompany number (officer names returned from the public register)UK

4. Section (c): the Customer's own tools

4.1 The Customer may connect its own tools to the Service. The Customer is the vendor's customer and contracts with the vendor directly. ALPN connects to these tools only with the Customer's authorisation and uses them only on the Customer's instructions. They are not ALPN's sub-processors and are listed here for information.

ToolWhat the connection is used for
HubSpotCRM: connected by the Customer through HubSpot's authorisation flow
AttioCRM
InsightlyCRM
ZernioThe Customer's advertising accounts
JustCallPhone: receives call event notifications from the Customer's JustCall account only

4.2 CRM licences and other licences for these tools are not included in the Service.


5. Section (d): planned sub-processors

5.1 ALPN plans to use the providers below but does not use them yet. ALPN will give at least 30 days' notice under clause 7 of the DPA before it starts to use either of them for personal data.

ProviderPlanned purposePersonal data expected
RevolutALPN may use this to collect payments in future. Today you pay by bank transfer on invoice.Billing contact details (not yet confirmed)
UnipileSending email and LinkedIn messages, replacing SalesforgeProspect name and contact details, sent copy, replies (not yet confirmed)

6. Change log

6.1 2026-11-10: Google Analytics was removed from get-recon.com and app.get-recon.com. Google is no longer used for analytics. Google is still listed for sign-in, Calendar and Meet, and for business lookups.