Sub-processors
The third-party providers Gapfy uses to deliver its Services, the data they handle, where they process it and the transfer safeguards that apply.
Last updated: 13 July 2026
Gapfy uses the sub-processors below to provide its Services. Each is engaged under a data-processing agreement with obligations no less protective than our own. This page is referenced by our Data Processing Agreement and Privacy policy.
Infrastructure and platform sub-processors
| Provider | Purpose | Data handled | Location | Transfer safeguard |
|---|---|---|---|---|
| Microsoft (Azure) | Cloud hosting - compute, databases, storage, messaging and cache. | All account and Customer Data. | European Union (West Europe) | Processing in the EEA; SCCs and the EU-US Data Privacy Framework cover any residual remote access (for example support) from outside the EEA. |
| Microsoft (Entra External ID) | Identity and authentication. | Account identifier, email, name. | European Union | Processing in the EEA; SCCs and the EU-US Data Privacy Framework cover any residual remote access from outside the EEA. |
| Microsoft (Azure OpenAI Service / Azure AI Foundry) | AI inference and text embeddings for the optional AI features. | The prompt and product content sent when you use an AI feature. | European Union (EU Data Zone deployment; resource and data at rest in West Europe) | Processing in the EEA; SCCs and the EU-US Data Privacy Framework cover any residual remote access from outside the EEA. |
| Microsoft (Azure AI Search) | Vector index backing AI semantic search and retrieval. | Indexed text and its embedding, isolated per organisation. | European Union (West Europe) | Processing in the EEA; SCCs and the EU-US Data Privacy Framework cover any residual remote access from outside the EEA. |
| Microsoft (Azure Communication Services) | Transactional email (notifications, invites). | Recipient email and message content. | European Union | Processing in the EEA; SCCs and the EU-US Data Privacy Framework cover any residual remote access from outside the EEA. |
| Stripe | Payment processing and subscription billing. Stripe processes billing data for Gapfy as controller and also acts as an independent controller for payment execution, fraud prevention and its own legal obligations. | Billing and payment data. | European Union / United States | Standard Contractual Clauses |
| Twilio | SMS notification delivery, where the customer enables SMS notifications. | Phone number and message content. | United States | Standard Contractual Clauses |
| Cloudflare | Bot and abuse protection (Turnstile) on public forms, and authoritative DNS for the gapfy.io domains. | IP address and request metadata. | Global (EU edge where available) | Standard Contractual Clauses |
All AI calls are routed through Gapfy's own AI gateway, which screens content before transmission and keeps processing within the EU. The gateway does not store prompts or responses in a database; a short-lived response cache may hold results for up to 24 hours and embedding vectors for up to 30 days. Microsoft does not use content sent to these AI services to train its models. Under Microsoft's standard Azure OpenAI abuse-monitoring, Microsoft may retain prompts and outputs for up to 30 days, within the same EU data zone, to detect misuse, unless that monitoring is disabled for the subscription; we will update this page if that configuration changes. We do not currently use any non-EU AI model provider; should we enable one in future (for example an additional frontier model), we will add it here and give advance notice to customers under a Data Processing Agreement before activating it.
Other third-party technologies
The following third parties are not engaged as sub-processors of Customer Data, but receive limited data when you use certain surfaces, and we list them for transparency:
- DuckDuckGo - used by Gapfy Harmony (extension and web app) to display website icons (favicons); your browser requests the icon directly, so DuckDuckGo receives your IP address and the domain of the saved link. It does not receive the link itself or any account data.
- Google (Chrome Web Store) - distributes the Gapfy Harmony browser extension; Google acts as an independent controller of store interactions under its own terms.
- Microsoft (Edge Add-ons) - distributes the Gapfy Harmony extension for Microsoft Edge; Microsoft acts as an independent controller of store interactions under its own terms.
- Microsoft (Microsoft Store) - distributes the Gapfy Echo and Gapfy Riff desktop apps; Microsoft acts as an independent controller of store interactions under its own terms.
The fonts on our websites and web apps are self-hosted on our own infrastructure; no font request is sent to Google or any other third party.
Changes
We update this list when we add, replace or remove a sub-processor. Customers under a Data Processing Agreement receive at least 30 days' advance notice of changes, as described in that agreement, and may object as set out there.
This English-language version is the authoritative, legally binding version of this document. Translations are provided for convenience only.