Sub-processors
Last updated: May 22, 2026
Kindora, PBC engages the third-party sub-processors below to process Personal Data on behalf of customers in the course of providing the Services. Each is engaged under a data processing agreement with terms no less protective than Kindora's own DPA.
We give customers at least 30 days' notice before adding or replacing a sub-processor. Customers may also request email notice by contacting privacy@kindora.co.
No Customer Data is used to train AI providers' underlying models when we use their business APIs.
Infrastructure & hosting
| Sub-processor | Purpose | Personal Data processed | Region | DPA |
|---|---|---|---|---|
| Supabase Inc. | Primary database, authentication, file storage | All Customer Data | United States | supabase.com/legal/dpa |
| Microsoft Azure | Backend application compute/hosting | Customer Data in processing | United States (East US 2) | Microsoft Products & Services DPA |
| Vercel Inc. | Frontend application hosting / edge | Application traffic, limited account PII | United States | vercel.com/legal/dpa |
AI model providers
| Sub-processor | Purpose | Personal Data processed | Region | DPA |
|---|---|---|---|---|
| Anthropic, PBC (Claude) | AI generation: Intel Briefs, drafting, matching, chat | Prompts that may include org/funder/contact data | United States | Commercial Terms + DPA |
| OpenAI, L.L.C. | AI generation and text embeddings | Prompts and embeddings of submitted context | United States | openai.com/policies/data-processing-addendum |
| Perplexity AI, Inc. | AI-assisted web research | Research queries that may include names | United States | perplexity.ai DPA |
| Cohere Inc. | Text embeddings / reranking | Embeddings of org/funder content | United States / Canada | cohere.com DPA |
Research & enrichment
| Sub-processor | Purpose | Personal Data processed | Region | DPA |
|---|---|---|---|---|
| Tavily | Web search for prospect/donor intelligence | Search queries that may include names | United States | per Tavily terms |
| Apify | Web scraping for board/network and LinkedIn data | Publicly available individual profile data | United States / EU | apify.com/data-processing-agreement |
| Firecrawl | Web crawling of funder pages | Web page content | United States | per Firecrawl terms |
| OutScraper | Google/news search for funder research | Search queries and public web results | United States / EU | per OutScraper terms |
| Enrich Layer | Contact/profile enrichment and email lookup | LinkedIn/profile URLs, names, employment and education signals | United States | per Enrich Layer terms |
| Tomba | Email discovery and verification | Names, domains, LinkedIn URLs, email addresses | EU / United States | tomba.io privacy/DPA terms |
| Decodo | Residential proxy for public real-estate enrichment requests | Request metadata and public-source lookup traffic | EU / United States | decodo.com legal terms |
Payments, email, analytics & monitoring
| Sub-processor | Purpose | Personal Data processed | Region | DPA |
|---|---|---|---|---|
| Stripe, Inc. | Payment processing and subscriptions | Billing contact and payment data | United States | stripe.com/legal/dpa |
| Resend | Transactional email delivery | Recipient name and email | United States | resend.com DPA |
| MailerLite (UAB MailerLite) | Marketing email / newsletters | Subscriber name and email | EU (Lithuania) / United States | mailerlite.com/legal/dpa |
| PostHog Inc. | Product analytics | Usage events and user identifiers | United States (US Cloud) | posthog.com/dpa |
| Functional Software, Inc. (Sentry) | Error monitoring | Error context that may include limited PII | United States | sentry.io/legal/dpa |
Not Sub-processors
- Blackbaud Raiser's Edge NXT, Salesforce, and other CRMs you connect are your own systems, not Kindora's sub-processors.
- Candid and IRS/public 990 datasets are data sources of public organizational records, not processors of Customer Personal Data.
- LinkedIn Marketing API is used for Kindora's own marketing and does not process Customer Personal Data on your behalf.