Sub-processors
Last updated: October 5, 2026
Kindora, PBC engages the third-party sub-processors below to process Personal Data on behalf of customers in the course of providing the Services. Our infrastructure, AI model, payment, email, analytics and monitoring providers are engaged under each provider's own data processing agreement. Some research and enrichment vendors are engaged under the vendor's standard published terms, with data-use and training settings configured in Kindora's account with that vendor; we are putting negotiated agreements in place and will state the position for any vendor on request.
We give customers at least 14 days' notice before adding or replacing a sub-processor, or any longer period a customer's agreement provides. Customers may also request email notice by contacting privacy@kindora.co.
No Customer Data is used to train AI providers' underlying models when we use their business APIs.
Infrastructure & hosting
| Sub-processor | Purpose | Personal Data processed | Region | DPA |
|---|---|---|---|---|
| Supabase Inc. | Primary database, authentication, file storage | All Customer Data | United States | supabase.com/legal/dpa |
| Microsoft Azure | Backend application compute/hosting | Customer Data in processing | United States (East US 2) | Microsoft Products & Services DPA |
| Redis Cloud (Redis Ltd.) | Task queue and cache | Transient job payloads and cached results | United States (AWS us-west-1) | redis.io/legal/data-processing-addendum |
| Vercel Inc. | Frontend application hosting / edge | Application traffic, limited account PII | United States | vercel.com/legal/dpa |
AI model providers
| Sub-processor | Purpose | Personal Data processed | Region | DPA |
|---|---|---|---|---|
| Anthropic, PBC (Claude) | AI generation: Intel Briefs, drafting, matching, chat | Prompts that may include org/funder/contact data | United States | Commercial Terms + DPA |
| OpenAI, L.L.C. | AI generation and text embeddings | Prompts and embeddings of submitted context | United States | openai.com/policies/data-processing-addendum |
| Perplexity AI, Inc. | AI-assisted web research | Research queries that may include names | United States | perplexity.ai DPA |
| Cohere Inc. | Text embeddings / reranking | Embeddings of org/funder content | United States / Canada | cohere.com DPA |
Research & enrichment
| Sub-processor | Purpose | Personal Data processed | Region | DPA |
|---|---|---|---|---|
| Tavily | Web search for prospect/donor intelligence | Search queries that may include names | United States | per Tavily terms |
| Apify | Web scraping for board/network and LinkedIn data | Publicly available individual profile data | United States / EU | apify.com/data-processing-agreement |
| Firecrawl | Web crawling of funder pages and web search for prospect research | Web page content; search queries that may include names | United States | per Firecrawl terms |
| OutScraper | Google/news search for funder research | Search queries and public web results | United States / EU | per OutScraper terms |
| Enrich Layer | Contact/profile enrichment and email lookup | LinkedIn/profile URLs, names, employment and education signals | United States | per Enrich Layer terms |
| Tomba | Work-email discovery (backup finder) and email verification (fallback verifier) | Names, employer domains, LinkedIn URLs, email addresses | EU / United States | tomba.io privacy/DPA terms |
| GBD Software as a Service Ltd. (MillionVerifier) | Email verification: checks that a found work email address can receive mail | Email addresses | Hungary (EU) | MillionVerifier DPA |
| Hunter Web Services, Inc. (Hunter) | Work-email discovery when Kindora's own check cannot confirm an address (from November 1, 2026) | Names and employer domains of people a customer chose to research; found email addresses | Belgium (EU) / United States | hunter.io/data-processing-agreement |
| Decodo | Residential proxy for public real-estate enrichment requests | Request metadata and public-source lookup traffic | EU / United States | decodo.com legal terms |
Payments, email, analytics & monitoring
| Sub-processor | Purpose | Personal Data processed | Region | DPA |
|---|---|---|---|---|
| Stripe, Inc. | Payment processing and subscriptions | Billing contact and payment data | United States | stripe.com/legal/dpa |
| Resend | Transactional email delivery | Recipient name and email | United States | resend.com DPA |
| MailerLite (UAB MailerLite) | Marketing email / newsletters | Subscriber name and email | EU (Lithuania) / United States | mailerlite.com/legal/dpa |
| PostHog Inc. | Product analytics | Usage events and user identifiers | United States (US Cloud) | posthog.com/dpa |
| Functional Software, Inc. (Sentry) | Error monitoring | Error context that may include limited PII | United States | sentry.io/legal/dpa |
Not Sub-processors
- Blackbaud Raiser's Edge NXT, Salesforce, and other CRMs you connect are your own systems, not Kindora's sub-processors.
- Candid and IRS/public 990 datasets are data sources of public organizational records, not processors of Customer Personal Data.
- LinkedIn Marketing API is used for Kindora's own marketing and does not process Customer Personal Data on your behalf.