Sub-processors

LeadLog uses the following third-party service providers (sub-processors) to deliver our service. This page is maintained in accordance with our Data Processing Agreement.

We will notify customers of any material changes to this list. If you have concerns about a sub-processor, please contact us at hello@leadlog.app.

Current Sub-processors

Provider	Purpose	Location	Transfer Mechanism
Google Firebase Google Ireland Limited	Cloud infrastructure, hosting, Firestore database, Cloud Storage, Authentication, Cloud Functions	EU (Belgium) europe-west1	Adequacy decision (EU-based processing)
OpenAI OpenAI, LLC	Whisper API: Voice transcription GPT-4o-mini: Contact data extraction from transcripts GPT-4o Vision: Business card OCR	United States	EU-US Data Privacy Framework + Standard Contractual Clauses
Stripe Stripe Payments Europe, Ltd	Payment processing, subscription management, invoicing	EU (Ireland)	Adequacy decision (EU-based processing)
Umami Self-hosted analytics	Privacy-focused website analytics (marketing site only, no personal data collected)	EU	N/A (no personal data processed)

Data Processing Details

Google Firebase

Entity: Google Ireland Limited (EU controller for EEA users)

Services used:

• Firebase Authentication: User identity management (Google OAuth, email/password)
• Cloud Firestore: NoSQL database for lead data and user accounts
• Cloud Storage: Storage for voice recordings and business card images
• Cloud Functions: Server-side processing (deployed in europe-west1)
• Firebase Hosting: Web application delivery

Data location: europe-west1 (Belgium) for Cloud Functions. Firestore and Storage configured for EU region where available.

Privacy documentation: Firebase Privacy and Security

OpenAI

Entity: OpenAI, LLC (San Francisco, USA)

Services used:

• Whisper API: Converts voice recordings to text transcripts
• GPT-4o-mini: Extracts structured contact data from transcripts
• GPT-4o Vision: Extracts contact data from business card images

Data handling:

• Data sent via API is NOT used to train OpenAI models (per their API data usage policy)
• Data is processed transiently and not stored beyond what's needed for the API request
• OpenAI is certified under the EU-US Data Privacy Framework

Privacy documentation: OpenAI API Data Usage Policy

Stripe

Entity: Stripe Payments Europe, Ltd (Dublin, Ireland)

Services used:

• Subscription billing and payment processing
• Customer portal for subscription management
• Webhook notifications for subscription events

Data processed: Email address, billing address, payment card details (card details never touch LeadLog servers)

Data location: EU (Ireland)

Privacy documentation: Stripe Privacy Policy

Umami

Service type: Privacy-focused web analytics

Data collected: Aggregated, anonymous page view statistics (no personal data, no cookies, no IP addresses stored)

Scope: Marketing website (leadlog.app) only, not the application

Changes to Sub-processors

We may update our sub-processors from time to time. When we add or replace a sub-processor that processes personal data, we will:

• Update this page with the new sub-processor details
• Notify customers via email for material changes
• Provide customers an opportunity to object

If you have questions about our sub-processors or wish to be notified of changes, contact us at hello@leadlog.app.