Legal
Sub-processors
This page lists the third parties engaged by Scalelist in the provision and operation of its services, in accordance with Article 28(2) of the GDPR.
Sub-processors are engaged under written contract, on data protection terms substantially equivalent to those set out in Scalelist’s Data Processing Agreement, and process personal data solely on Scalelist’s instructions.
Where a sub-processor is located outside the European Economic Area, transfers are made on the basis of an adequacy decision or the Standard Contractual Clauses, as described in Section 9 of the Privacy Policy. The mechanism applying to a particular sub-processor is available on request at privacy@scalelist.com.
Scalelist notifies Users at least 15 days before engaging a new sub-processor.
Advertising and analytics providers set cookies or similar technologies on our website and platform and act as independent controllers in respect of the data they collect. They are described in our Cookie Policy rather than on this page.
Part A. Published sub-processors
Infrastructure and hosting
| Sub-processor | Purpose | Categories of personal data | Location |
|---|---|---|---|
| Amazon Web Services, Inc. | Application, API and worker hosting; caching; encrypted database backup storage | All personal data processed by the services | United States |
| MongoDB, Inc. | Primary database (MongoDB Atlas) and operational dashboards (Atlas Charts) | Account data, lead records, enrichment audit records, conversation history | European Union (Paris) |
| DigitalOcean, LLC | Managed PostgreSQL database, contact cache, phone cache, domain patterns | Names, professional email addresses, telephone numbers, professional profile identifiers | United States |
| Upstash, Inc. | Managed cache and rate limiting for the web application | Enrichment results held transiently; hashed network identifiers | United States |
| SiteGround Hosting Ltd. | Hosting of the scalelist.com website | Data submitted through website forms; network identifiers | Singapore |
| Cloudinary Ltd. | Storage of User profile images | Profile image, User identifier | Israel |
Billing
| Sub-processor | Purpose | Categories of personal data | Location |
|---|---|---|---|
| Stripe, Inc. | Payment processing, subscription management and invoicing | Name, email address, billing details, transaction records | United States |
Communication and support
| Sub-processor | Purpose | Categories of personal data | Location |
|---|---|---|---|
| Google LLC | Transactional email delivery (Google Workspace); internal documents | Recipient address, message content and attachments | United States |
| Brevo (Sendinblue SAS) | Marketing and lifecycle email | Email address, name, country, company name and size, industry, plan and usage attributes | European Union (France) |
| Intercom, Inc. | Customer support messaging and help documentation | Name, email address, account and plan attributes, content of support conversations | United States |
| Slack Technologies, LLC | Internal operational notifications | Name, email address, company name, professional profile URL | United States |
Artificial intelligence
| Sub-processor | Purpose | Categories of personal data | Location |
|---|---|---|---|
| OpenRouter, Inc. | Routing of model requests generated by the Leads Finder feature | User’s request; where applicable, professional contact data from the User’s own list | United States |
| Google LLC | Language model (Gemini) used in the Leads Finder feature | User’s request; where applicable, professional contact data from the User’s own list | United States |
| Anthropic, PBC | AI assistance for internal analysis, development and operations | Data processed on an ad hoc basis without persistence | United States |
| OpenAI, L.L.C. | AI assistance for internal analysis, development and operations | Data processed on an ad hoc basis without persistence | United States |
Model providers process personal data on an inference-only basis. Data transmitted to them is not retained after the response has been generated, and is not used to train, fine-tune or evaluate any model. Within the Scalelist platform, artificial intelligence is used only in the Leads Finder feature; it is not used in the Email Finder, the Phone Finder, bulk enrichment, or the Scalelist API.
Security and fraud prevention
| Sub-processor | Purpose | Categories of personal data | Location |
|---|---|---|---|
| Fingerprint, Inc. | Detection of fraudulent and duplicate account registration | Device characteristics, network identifier, approximate location | United States |
| Cloudflare, Inc. | Bot protection on public-facing forms | Network identifier, challenge token | United States |
| CookieYes Limited | Cookie consent management and consent record keeping | Consent choice, network identifier, consent timestamp | United Kingdom |
Part B. Data providers (confidential list)
In connection with the provision of the enrichment services, Scalelist engages specialist providers in the following categories:
| Category | Purpose | Categories of personal data |
|---|---|---|
| Contact data providers | Resolution of professional email addresses and telephone numbers that Scalelist cannot resolve from its own systems | Full name, company name, company domain, professional email address, professional and mobile telephone number, job title, location, professional profile URL |
| Email verification providers | Confirmation of the deliverability of an email address before a result is returned | Professional email address, company domain |
| Company identification providers | Resolution of a company name to a corporate domain | Company name only |
Confidentiality of the nominative list. The identity of Scalelist’s data providers, the location of each, and the order in which they are engaged, constitute confidential information and a trade secret of Scalelist, protected as such under the law of Singapore and under the confidentiality provisions of Scalelist’s Terms of Service. The selection and ordering of these providers is a material element of the Service and of Scalelist’s competitive position.
Disclosure to Users. The complete nominative list, including the identity, location and applicable transfer mechanism of each provider, is communicated to Users upon written request to privacy@scalelist.com, within five business days, subject to the prior execution of a non-disclosure agreement. The User undertakes not to disclose that list, or the information contained in it, to any third party, and to use it solely for the purpose of verifying Scalelist’s compliance with applicable data protection law.
Right of objection. The notification and objection mechanism set out in Section 7.4 of the Data Processing Agreement applies in full to the providers listed in this Part B. Users are notified of any change no fewer than 15 days before it takes effect, even where the identity of the new provider is communicated only under non-disclosure agreement.
Common safeguards. Scalelist warrants that each provider in this Part B (a) is contractually bound by data protection obligations substantially equivalent to those set out in the Data Processing Agreement, (b) is located within the EEA or is covered by a transfer mechanism compliant with Chapter V of the GDPR, and (c) processes personal data solely within the scope of Scalelist’s instructions and solely for the purposes of the enrichment services.
Destinations you direct us to
The following are not sub-processors. Where you instruct Scalelist to transmit data to them, Scalelist acts on your instruction and you determine the destination. Your relationship with each of these providers is governed by your own agreement with them.
| Destination | When data is transmitted |
|---|---|
| HubSpot, Lemlist, Instantly, Smartlead, Saleshandy, Woodpecker | When you connect the integration and push leads to it |
| Any webhook URL you supply | When you provide a webhook_url on an API request, Scalelist delivers the full result set to that address |
You are responsible for the security and lawfulness of any destination you nominate, and for ensuring that transmission to it complies with applicable data protection law.
Scalelist, a service operated by TGID Export Pte. Ltd., 21 Collyer Quay, #02-01, Singapore 049320, UEN 201903371Hprivacy@scalelist.com