Sub-processor List

    Last updated: September 14, 2026

    GTM Heroes, Inc. uses the following third parties to process personal data on behalf of our customers in delivering the GTM Heroes service. We give customers 30 days' notice before adding a sub-processor, and customers may object on reasonable data-protection grounds under their Data Processing Addendum. Tools you connect under your own account (your CRM, your conversation-intelligence platform) are Connected Services governed by your own agreement with that provider, not sub-processors.

    Sub-processorPurposePersonal data processedLocation
    Supabase, Inc.Application hosting, database, authentication, file storageAll customer data and prospect data in the serviceUnited States (AWS us-east-1)
    Cloudflare, Inc.DNS, content delivery, edge securityRequest metadata and IP addresses in transitUnited States, global edge
    Lovable LabsApplication front-end hosting and buildCustomer data in transit to the applicationEuropean Union / United States
    Anthropic, PBCAI inference for operational processing of service data (support triage, signup activation, service monitoring)User email addresses and names, support and feedback text, service request metadataUnited States. API tier; not used for model training. Provider may retain inputs up to 30 days for abuse monitoring.
    Google LLC (Gemini API)AI inference for behavioral analysis and generated content in the applicationProspect names, roles, public professional content, email and call content submitted for analysis, behavioral profilesUnited States. Paid API tier; not used for model training.
    Humantic AIBehavioral profile generation from public professional profilesProspect name, LinkedIn profile URL, returned behavioral profileUnited States
    Apollo.ioEnrichment of prospect records a customer uploads or syncs into the serviceBusiness contact data of the customer's prospects (name, title, company, business email, phone)United States
    ResendTransactional email (authentication, notifications)User email address, notification contentUnited States
    Stripe, Inc.Payment processingBilling contact, payment tokensUnited States
    Google LLC (Calendar and Meet APIs)Google Calendar and Google Meet access when a customer connects GoogleCalendar event metadata (title, time, attendees) and Google Meet conference records and transcripts from the connected accountUnited States
    Slack TechnologiesOpt-in customer notificationsNotification payloads, only when a customer enables Slack deliveryUnited States
    HeyGenAI video avatar ("twin") generationName, likeness, and voice of users who opt in to an AI twinUnited States

    We do not sell personal data. Customer data and prospect data are not used to train any AI model, ours or a sub-processor's. Questions: [email protected].

    Contact