Sub-processors – The Bell CRM
Last updated: 23 October 2026
ChangeSales Oy ("we") uses the following third-party infrastructure providers ("sub-processors") to deliver The Bell CRM. Each sub-processor has been selected for their compliance with applicable data protection requirements, including the EU General Data Protection Regulation (GDPR).
We will update this page when sub-processors are added or removed. Material changes will be notified to customers in accordance with our Terms of Service.
Current Sub-processors
| Provider | Purpose | Data location | Privacy information |
|---|---|---|---|
| Supabase | Database and file storage | United Kingdom (London). The UK has an EU adequacy decision under GDPR. | supabase.com/privacy |
| Clerk | User authentication and identity management | United States (EU-U.S. Data Privacy Framework) | clerk.com/privacy |
| Stripe | Payment processing and subscription management | EU (Stripe Payments Europe, Ireland) / United States (EU-U.S. Data Privacy Framework and EU Standard Contractual Clauses) | stripe.com/privacy |
| Vercel | Application hosting and content delivery | Application hosted in the EU (Frankfurt). Vercel Inc. is a US company; transfers covered by the EU-U.S. Data Privacy Framework and EU Standard Contractual Clauses. | vercel.com/legal/privacy-policy |
| SendGrid (Twilio) | Transactional email delivery (account, invite, billing and form submission notifications) | US (SCCs) | twilio.com/legal/privacy |
| Anthropic | AI processing of text you choose to submit to Smart Input and Discovery Calls (notes, call transcripts) | United States (EU Standard Contractual Clauses) | anthropic.com/legal/data-processing-addendum |
| Upstash | Rate limiting to protect public forms and the API from abuse (IP addresses, kept for minutes) | EU (Frankfurt) | upstash.com/trust/privacy.pdf |
Data Transfers Outside the EU
Where sub-processors are located outside the European Economic Area (EEA), data transfers are governed by Standard Contractual Clauses (SCCs) as approved by the European Commission, or by an applicable adequacy decision. We do not transfer Customer Data outside the EEA without an appropriate legal mechanism in place.
Questions
If you have questions about our sub-processors or data processing practices, contact us at info@thebellcrm.eu.