Sub-processor List

Effective 2026-09-11 · Last updated 2026-09-11

Questions about this policy? Contact support@crmish.io.

Accuracy and contact-status notice. JAS Operations LLC dba CRMish operates the Service. The verification record LEGAL-VERIFIED-FACTS.json dated 2026-09-24 records verified live integration for Turso, Stripe, and Vercel. It does not verify retention, region, certification, incident-response timing, or signed data-processing-agreement terms for those providers. Current project records do not verify a monitored public CRMish mailbox.

1. About this list

CRMish (operated by JAS Operations LLC dba CRMish) engages third-party providers ("sub-processors") to deliver parts of the Service. Our requirements for sub-processors are described in the Data Processing Addendum.

We update this list at least 30 days before adding or replacing a sub-processor that processes personal data, unless an emergency security or service-continuity issue requires faster action. Customers with an executed Data Processing Addendum may subscribe to change notifications at privacy@crmish.io.

2. Current sub-processors

Infrastructure and hosting

| Provider | Purpose | Data categories | Region | Retention | |---|---|---|---|---| | Vercel | Web hosting, edge delivery, server-functions runtime, environment-variable/secrets storage, and file storage (Vercel Blob — conversation-screenshot attachments) | All customer data passes through Vercel infrastructure; uploaded screenshot images specifically | United States (primary), global edge | Screenshots: 12-month retention cron (src/lib/actions/attachmentsRetention.ts). Platform data: while the account is active | | Turso (libSQL) | Primary database — all workspace data, account info, webhook events, push subscriptions, billing references, AI embeddings | Account info, workspace content, audit logs, vector embeddings of uploaded training documents | United States | While the account is active; deleted rows purge on the schedule in Privacy Policy §10 |

AI and automation processing

| Provider | Purpose | Data categories | Region | Retention | |---|---|---|---|---| | Anthropic | Powers Mish, the in-app/Telegram AI agent (conversation, tool-calling, proactive nudges), the AI Coaching panel, Teamwork document-to-task extraction, and auxiliary drafting (workflow creation, call-outcome extraction, email drafting) | Structured prompts built from record/workspace context (engagement scores, conversation excerpts, notes, activity); Telegram message text routed through Mish; PDF or text documents a user chooses for Teamwork task extraction | United States | Per Anthropic's commercial API terms (not used to train models); Teamwork source files are processed transiently and are not stored by CRMish; approved task text is stored in the workspace | | OpenAI | Voice-note transcription (Whisper, via Mish's Telegram voice flow), text-to-speech for the Morning Voice Brief, and text embeddings for Mish's document/RAG memory | Audio bytes of voice notes (transcribed, not retained by CRMish beyond the resulting text); script text for speech synthesis; text chunks of user-uploaded training documents (embedded as vectors) | United States — confirm with vendor | Audio/script processed transiently per call, not stored as raw audio/speech by CRMish. Embeddings persist in Turso until the source document is deleted (self-maintaining account purge, src/lib/account/purge.ts) | | Google (Gemini API) | Parses uploaded conversation-DM screenshots into structured fields (prospect name, platform, summary, next step) | Screenshot image bytes (uploaded conversation/DM captures) | United States — confirm with vendor | Image processed transiently per call; the uploaded image itself is retained in Vercel Blob per the 12-month attachment retention cron, independent of Gemini's processing |

Productivity integrations (user-authorized)

These connect when a user explicitly links their own mailbox or calendar in Settings → Integrations. CRMish acts on the user's behalf using an OAuth token the user grants and can revoke at any time.

| Provider | Purpose | Data categories | Region | Retention | |---|---|---|---|---| | Google (Gmail + Calendar) | Send/read mail via Gmail API (gmail.send, gmail.readonly scopes) and read/write Calendar events via Calendar API, when a user connects their Google account | OAuth access/refresh tokens (encrypted at rest, AES-256-GCM — src/lib/crypto/oauth-tokens.ts); mailbox/calendar content only for the connected user's own account, fetched on demand | United States / global — confirm with vendor | Tokens retained until the user disconnects the integration or deletes their account (self-maintaining account purge); Google's own retention governs their side | | Microsoft (Outlook / Graph API) | Send/read mail via Microsoft Graph (Mail.Send, Mail.Read, User.Read, offline_access scopes), when a user connects their Outlook/Microsoft account | OAuth access/refresh tokens (encrypted at rest, same as Google above); mailbox content only for the connected user's own account | United States / global — confirm with vendor | Same as Google row above |

Messaging and chat transport

| Provider | Purpose | Data categories | Region | Retention | |---|---|---|---|---| | Telegram | Chat transport for Mish — CRMish's bot (@Crmish_bot) sends/receives messages, voice notes, and photos so users can work the CRM from Telegram instead of the web app | Message text, voice-note audio, photos sent to/from the bot; Telegram user/chat ID | Confirm with vendor — Telegram's infrastructure is globally distributed and a specific processing region is not published | Update IDs are deduped for delivery idempotency (telegram_updates_seen); message content follows the same workspace-data retention as the feature it feeds (e.g., a logged conversation) | | Twilio | SMS delivery — phone verification codes, password-reset codes, TOTP-recovery codes, and workflow SMS steps | Destination phone number, message body (typically a one-time code or a user-authored workflow message) | United States — confirm with vendor | Not persisted by CRMish beyond standard application/security logs; Twilio's own retention governs their side |

Payments

| Provider | Purpose | Data categories | Region | Retention | |---|---|---|---|---| | Stripe | Payment processing, subscription management, tax calculation, fraud detection, affiliate payouts (Stripe Connect) | Name, email, billing address, payment method (Stripe collects directly); payout details for affiliates | United States, EU | Per Stripe's own retention; billing records referenced in Privacy Policy §10 (7 years, tax requirement) |

Communications

| Provider | Purpose | Data categories | Region | Retention | |---|---|---|---|---| | Resend | Transactional email — password resets, invites, billing receipts, sprint nudges, Daily Drop, scheduled sends | Email address, message contents | United States | Per Resend's own retention | | Mozilla / Google / Apple push services | Web push notification delivery via the Web Push API (per-browser) | Push subscription endpoint, notification payload | Global | Retained until the user disables push or the browser endpoint expires |

Affiliate program

| Provider | Purpose | Data categories | Region | Retention | |---|---|---|---|---| | Partnr | Powers the CRMish affiliate program end to end — affiliate onboarding, commission/payout processing (via Stripe Connect), tax-document (1099) generation, tracking links, and payout-related webhooks | Affiliate account identifiers, commission/payout amounts, tax-form data, tracking-link activity | United States — confirm with vendor | Per the CRMish–Partnr platform agreement; not separately re-hosted by CRMish beyond the reference IDs needed to reconcile payouts |

Security

| Provider | Purpose | Data categories | Region | Retention | |---|---|---|---|---| | Cloudflare | Turnstile bot-protection challenge on sign-up, sign-in, and application-form surfaces | IP address, browser metadata, challenge response | Global | Per Cloudflare's own retention | | Sentry | Error and performance monitoring (exceptions, stack traces, performance traces). Session Replay is disabled (replaysOnErrorSampleRate: 0) as of 2026-07-12 — see the Security Overview — so Sentry does not currently receive screen recordings. Error/breadcrumb payloads are scrubbed of query strings, cookies, Authorization headers, emails, and phone-number-shaped text before they leave the app (src/lib/observability/sentryScrub.ts) | Stack traces, error messages (scrubbed), request path (query string stripped), performance timing | United States | Per Sentry's own retention |

Internal tooling (no customer-data processing)

| Provider | Purpose | Data categories | Region | |---|---|---|---| | GitHub | Source-code hosting | None — no customer data | United States | | 1Password | Internal credential storage | None — no customer data | Canada | | Northwest Registered Agent | Registered agent for JAS Operations LLC dba CRMish | None — entity records only | United States |

3. International transfers

Most sub-processors are based in the United States. Where the GDPR / UK GDPR applies, transfers are governed by the Standard Contractual Clauses (SCCs) included in each sub-processor's data-processing terms, supplemented by transfer-impact assessment where required. For details of the transfer arrangements that apply to your data, contact privacy@crmish.io.

4. Sub-processor selection

We select sub-processors based on:

  • Their published security and privacy practices.
  • Their willingness to enter into a data-processing addendum incorporating SCCs.
  • Their compliance certifications (SOC 2, ISO 27001) where applicable.
  • Operational fit for the purpose.

5. Change notification

We will notify Data Processing Addendum signatories at least 30 days before:

  • Adding a new sub-processor that will process customer personal data.
  • Replacing a current sub-processor with a different provider.

Notification will be sent to the email on file. Customers who object to a new sub-processor may terminate the affected service per the DPA.

6. Removed sub-processors

| Provider | Removed on | Reason | Replaced by | |---|---|---|---| | (none yet) | | | |

7. Contact

Questions about this list: privacy@crmish.io.