CRMish

Sub-processor List

Last updated: 2026-07-12 · DRAFT v5 — counsel review required

> DRAFT — counsel review required before publication. This revision was rewritten by walking the actual codebase (not memory of what the product used to do) after a launch audit found the list badly out of date: it named 8 providers when the app was actually calling on 13+. Every row below was verified against the client/call site that talks to that provider. Region and retention columns marked "confirm with vendor" are honest gaps, not oversights — do not treat them as confirmed until counsel/ops closes them out. > > Not legal advice. Working draft of the sub-processors that may process customer personal data on our behalf. Read alongside the Privacy Policy and Data Processing Addendum.

1. About this list

CRMish (operated by JAS Operations LLC dba CRMish) engages third-party providers ("sub-processors") to deliver parts of the Service. Each sub-processor is bound by contract to process customer data only on our documented instructions and only for the purposes listed below — contracts are being brought in line with this list as part of the counsel review noted above; do not represent any row below as contractually confirmed until that review closes.

We update this list at least 30 days before adding or replacing a sub-processor that processes personal data, unless an emergency security or service-continuity issue requires faster action. Customers with an executed Data Processing Addendum may subscribe to change notifications at privacy@crmish.io.

2. Current sub-processors

Infrastructure and hosting

| Provider | Purpose | Data categories | Region | Retention | |---|---|---|---|---| | Vercel | Web hosting, edge delivery, server-functions runtime, environment-variable/secrets storage, and file storage (Vercel Blob — conversation-screenshot attachments) | All customer data passes through Vercel infrastructure; uploaded screenshot images specifically | United States (primary), global edge | Screenshots: 12-month retention cron (src/lib/actions/attachmentsRetention.ts). Platform data: while the account is active | | Turso (libSQL) | Primary database — all workspace data, account info, webhook events, push subscriptions, billing references, AI embeddings | Account info, workspace content, audit logs, vector embeddings of uploaded training documents | United States | While the account is active; deleted rows purge on the schedule in Privacy Policy §10 |

AI and automation processing

| Provider | Purpose | Data categories | Region | Retention | |---|---|---|---|---| | Anthropic | Powers Mish, the in-app/Telegram AI agent (conversation, tool-calling, proactive nudges), the AI Coaching panel, Teamwork document-to-task extraction, and auxiliary drafting (workflow creation, call-outcome extraction, email drafting) | Structured prompts built from record/workspace context (engagement scores, conversation excerpts, notes, activity); Telegram message text routed through Mish; PDF or text documents a user chooses for Teamwork task extraction | United States | Per Anthropic's commercial API terms (not used to train models); Teamwork source files are processed transiently and are not stored by CRMish; approved task text is stored in the workspace | | OpenAI | Voice-note transcription (Whisper, via Mish's Telegram voice flow), text-to-speech for the Morning Voice Brief, and text embeddings for Mish's document/RAG memory | Audio bytes of voice notes (transcribed, not retained by CRMish beyond the resulting text); script text for speech synthesis; text chunks of user-uploaded training documents (embedded as vectors) | United States — confirm with vendor | Audio/script processed transiently per call, not stored as raw audio/speech by CRMish. Embeddings persist in Turso until the source document is deleted (self-maintaining account purge, src/lib/account/purge.ts) | | Google (Gemini API) | Parses uploaded conversation-DM screenshots into structured fields (prospect name, platform, summary, next step) | Screenshot image bytes (uploaded conversation/DM captures) | United States — confirm with vendor | Image processed transiently per call; the uploaded image itself is retained in Vercel Blob per the 12-month attachment retention cron, independent of Gemini's processing |

Productivity integrations (user-authorized)

These connect when a user explicitly links their own mailbox or calendar in Settings → Integrations. CRMish acts on the user's behalf using an OAuth token the user grants and can revoke at any time.

| Provider | Purpose | Data categories | Region | Retention | |---|---|---|---|---| | Google (Gmail + Calendar) | Send/read mail via Gmail API (gmail.send, gmail.readonly scopes) and read/write Calendar events via Calendar API, when a user connects their Google account | OAuth access/refresh tokens (encrypted at rest, AES-256-GCM — src/lib/crypto/oauth-tokens.ts); mailbox/calendar content only for the connected user's own account, fetched on demand | United States / global — confirm with vendor | Tokens retained until the user disconnects the integration or deletes their account (self-maintaining account purge); Google's own retention governs their side | | Microsoft (Outlook / Graph API) | Send/read mail via Microsoft Graph (Mail.Send, Mail.Read, User.Read, offline_access scopes), when a user connects their Outlook/Microsoft account | OAuth access/refresh tokens (encrypted at rest, same as Google above); mailbox content only for the connected user's own account | United States / global — confirm with vendor | Same as Google row above |

Messaging and chat transport

| Provider | Purpose | Data categories | Region | Retention | |---|---|---|---|---| | Telegram | Chat transport for Mish — CRMish's bot (@Crmish_bot) sends/receives messages, voice notes, and photos so users can work the CRM from Telegram instead of the web app | Message text, voice-note audio, photos sent to/from the bot; Telegram user/chat ID | Confirm with vendor — Telegram's infrastructure is globally distributed and a specific processing region is not published | Update IDs are deduped for delivery idempotency (telegram_updates_seen); message content follows the same workspace-data retention as the feature it feeds (e.g., a logged conversation) | | Twilio | SMS delivery — phone verification codes, password-reset codes, TOTP-recovery codes, and workflow SMS steps | Destination phone number, message body (typically a one-time code or a user-authored workflow message) | United States — confirm with vendor | Not persisted by CRMish beyond standard application/security logs; Twilio's own retention governs their side |

Payments

| Provider | Purpose | Data categories | Region | Retention | |---|---|---|---|---| | Stripe | Payment processing, subscription management, tax calculation, fraud detection, affiliate payouts (Stripe Connect) | Name, email, billing address, payment method (Stripe collects directly); payout details for affiliates | United States, EU | Per Stripe's own retention; billing records referenced in Privacy Policy §10 (7 years, tax requirement) |

Communications

| Provider | Purpose | Data categories | Region | Retention | |---|---|---|---|---| | Resend | Transactional email — password resets, invites, billing receipts, sprint nudges, Daily Drop, scheduled sends | Email address, message contents | United States | Per Resend's own retention | | Mozilla / Google / Apple push services | Web push notification delivery via the Web Push API (per-browser) | Push subscription endpoint, notification payload | Global | Retained until the user disables push or the browser endpoint expires |

Affiliate program

| Provider | Purpose | Data categories | Region | Retention | |---|---|---|---|---| | Partnr | Powers the CRMish affiliate program end to end — affiliate onboarding, commission/payout processing (via Stripe Connect), tax-document (1099) generation, tracking links, and payout-related webhooks | Affiliate account identifiers, commission/payout amounts, tax-form data, tracking-link activity | United States — confirm with vendor | Per the CRMish–Partnr platform agreement; not separately re-hosted by CRMish beyond the reference IDs needed to reconcile payouts |

Security

| Provider | Purpose | Data categories | Region | Retention | |---|---|---|---|---| | Cloudflare | Turnstile bot-protection challenge on sign-up, sign-in, and application-form surfaces | IP address, browser metadata, challenge response | Global | Per Cloudflare's own retention | | Sentry | Error and performance monitoring (exceptions, stack traces, performance traces). Session Replay is disabled (replaysOnErrorSampleRate: 0) as of 2026-07-12 — see the Security Overview — so Sentry does not currently receive screen recordings. Error/breadcrumb payloads are scrubbed of query strings, cookies, Authorization headers, emails, and phone-number-shaped text before they leave the app (src/lib/observability/sentryScrub.ts) | Stack traces, error messages (scrubbed), request path (query string stripped), performance timing | United States | Per Sentry's own retention |

Internal tooling (no customer-data processing)

| Provider | Purpose | Data categories | Region | |---|---|---|---| | GitHub | Source-code hosting | None — no customer data | United States | | 1Password | Internal credential storage | None — no customer data | Canada | | Northwest Registered Agent | Registered agent for JAS Operations LLC dba CRMish | None — entity records only | United States |

3. International transfers

Most sub-processors are based in the United States. Where the GDPR / UK GDPR applies, transfers are governed by the Standard Contractual Clauses (SCCs) included in each sub-processor's data-processing terms, supplemented by transfer-impact assessment where required. Rows marked "confirm with vendor" above do not yet have a signed DPA/SCC on file with CRMish — closing that paperwork is part of the counsel-review gate on this document.

4. Sub-processor selection

We select sub-processors based on:

  • Their published security and privacy practices.
  • Their willingness to enter into a data-processing addendum incorporating SCCs.
  • Their compliance certifications (SOC 2, ISO 27001) where applicable.
  • Operational fit for the purpose.

5. Change notification

We will notify Data Processing Addendum signatories at least 30 days before:

  • Adding a new sub-processor that will process customer personal data.
  • Replacing a current sub-processor with a different provider.

Notification will be sent to the email on file. Customers who object to a new sub-processor may terminate the affected service per the DPA.

6. Removed sub-processors

| Provider | Removed on | Reason | Replaced by | |---|---|---|---| | (none yet) | | | |

7. Contact

Questions about this list: privacy@crmish.io.

Document version: subprocessors-v2 · Last updated 2026-07-12. Supersedes v1 (2026-05-28), which listed 8 providers and omitted OpenAI, the Gemini image-processing path, Gmail/Calendar/Outlook integrations, Telegram, Twilio, and Partnr — all of which were already live in the code at the time. See PR "privacy: Sentry replay off + scrubbing; honest sub-processor list (DRAFT for counsel)" for the verification trail.