Loading SUBLAKELoading SUBLAKELast updated: October 16, 2026
To provide the SUBLAKE service, SUBLAKE Holdings LLC uses a small set of trusted third-party companies (“sub-processors”) that process personal data on our behalf. This page is the authoritative, current list. We keep it deliberately short and only use vendors that are contractually bound to protect your data. The maps also rely on a few public services, listed separately below, which receive only an address or a position on the map.
A sub-processor is a company we engage to help deliver the service — for example, to host data, deliver phone calls and text messages, process payments, or power the AI that answers and drafts messages. Each sub-processor may only process personal data to perform the specific task we’ve engaged them for, under a data-protection agreement, and never for their own purposes. We do not sell your data, and your data is never used to train general-purpose AI models.
| Sub-processor | What they process for us | Location |
|---|---|---|
| Supabase, Inc. | Database and file storage hosting | United States |
| Vercel, Inc. | Website and application hosting / content delivery | United States |
| Railway Corp. | Application (backend) hosting | United States |
| Anthropic, PBC | AI processing — understanding messages and drafting responses | United States |
| Vapi, Inc. | Real-time voice call handling for the AI Receptionist | United States |
| Twilio Inc. | Telephony and SMS delivery (phone numbers, calls, texts) | United States |
| Stripe, Inc. | Payment processing and payouts | United States |
| Resend (Plus Five Five, Inc.) | Transactional email delivery | United States |
| Functional Software, Inc. (Sentry) | Application error monitoring | United States |
| Google LLC | Address suggestions while an address is typed (including on your booking page) and finding your business and its time zone when you sign up; plus calendar sync and sign-in when you connect a Google account | United States |
| Meta Platforms, Inc. | WhatsApp, Instagram, and Messenger messaging — only if you connect it | United States |
Some sub-processors receive data only when you choose to connect an optional integration (for example, calendar sync or a social messaging channel). Those are marked above.
To place an address on a map, draw the map and plan a route, the service uses the public services below. They are not sub-processors: each runs a public service under its own published terms and is not engaged under a data processing agreement. That is why each receives only what the task needs — an address line, the text being typed, the part of the map being viewed, or the two ends of a route — and never a customer’s name, phone number or messages. An address that is found is kept, so it is not looked up again.
| Service | What it receives, and when | Based in |
|---|---|---|
| U.S. Census Bureau (Census Geocoder) | Placing a U.S. address on the map — our server sends the address line only | United States |
| OpenStreetMap Foundation (Nominatim) | Placing an address on the map outside the U.S., or one the Census Geocoder cannot find — our server sends the address line only | United Kingdom and other countries |
| komoot GmbH (Photon) | Address suggestions while an address is typed, only when Google address suggestions are switched off — our server sends the typed text only | Germany |
| OpenFreeMap | Background map imagery for the map views — your browser requests the squares of map being viewed | Europe (served via a global CDN) |
The service also includes place data we did not make: town names for the service-area line in the customer portal studio come from GeoNames, used under CC BY 4.0; time zones read from a business's address come from OpenStreetMap contributors, via timezone-boundary-builder, used under ODbL. Nothing is sent to them; the data is part of the product.
Our sub-processors host and process data in the United States; the public map services above are in the countries shown beside them. Where a transfer of personal data leaves the EEA, UK, or Switzerland, we rely on the appropriate safeguards described in our Data Processing Agreement (including the EU Standard Contractual Clauses and the UK Addendum). We do not publish internal system details beyond what is necessary for this transparency.
We may add or replace a sub-processor as the service evolves. When we do, we update this page. Customers with a Data Processing Agreement in place may request advance notice of new sub-processors (generally at least 30 days) and may raise a reasonable objection, as described in the DPA.
Questions about our sub-processors or a data-processing agreement? Email us at contact@sublake.com. See also our Privacy Policy, GDPR page, and Data Processing Agreement.