Xcout IntelXcout Intel — Sub-processors
Current as of version 2026-10-23
These are the providers that process data on our behalf. Each is engaged under that provider’s data processing agreement, which incorporates the European Commission’s 2021 Standard Contractual Clauses for transfers outside the EEA and the UK addendum where applicable.
| Provider | What it processes | Where | Transfer mechanism |
|---|---|---|---|
| SupabaseAccount data and dataset records | Database, authentication, and the edge functions that run the collectors. | United States (AWS) | SCCs via Supabase's DPA |
| VercelAccount data | Application hosting, edge network, and request logs. | United States, with EU edge regions | SCCs via Vercel's DPA |
| Dodo PaymentsAccount and billing data | Merchant of record: checkout, invoicing, tax collection and refunds. Card data is entered on Dodo Payments' checkout and never reaches our systems. | United States | Dodo Payments is an independent controller for the purchase it makes as reseller (SCCs per Dodo Payments' terms and privacy policy) |
| Google (Gemini API)Dataset records | Classification and extraction over public text — news articles, filings, company pages. Prompts may contain a person's name and role where the public source named them. | United States | SCCs via Google Cloud's DPA. Paid-tier API content is not used to train Google's models. |
| ResendAccount data | Transactional and digest email. | United States | SCCs via Resend's DPA |
| TwilioAccount data | WhatsApp messaging, where a user has connected that channel. | United States | SCCs via Twilio's DPA |
| CloudflareAccount data and dataset records | R2 object storage for off-site backups. | United States, with regional storage options | SCCs via Cloudflare's DPA |
Transfers into Israel
Xcout is established in Israel, which holds a European Commission adequacy decision (2011/61/EU, maintained following the Commission’s January 2024 review of pre-GDPR adequacy findings). Transfers of personal data from the EEA to us therefore rely on adequacy and require no separate mechanism. The UK maintains an equivalent finding for Israel. The Standard Contractual Clauses above cover the onward transfers to the providers in the table, most of which are in the United States.
Changes
We give notice before adding or replacing a sub-processor. Customers with a Data Processing Agreement in place may object on reasonable data-protection grounds; if we cannot accommodate the objection, the affected subscription may be terminated with a pro-rata refund of the unused period. To be notified of changes, or to ask a question about any entry above, write to hello@intel.xcout.app.