Subprocessors
Effective date: June 30, 2026
1. Subprocessor Notice
Dualhook will provide at least 30 days' notice before adding or replacing a subprocessor, unless urgent security, availability, legal, or provider-continuity needs require a shorter period. Objections can be sent to contact@dualhook.com.
Provider legal pages and account terms can change. Customer-facing procurement review should verify active plan, region, and DPA status in the relevant provider accounts, especially for services where those facts are account-specific.
2. Current Subprocessors
| Provider | Purpose | Data categories | Location / transfer notes | Provider materials |
|---|---|---|---|---|
| Clerk | Authentication, organization membership, user sessions, and account emails. | Account identifiers, organization identifiers, email addresses, authentication metadata, and session data. | Provider infrastructure and subprocessors as described in Clerk's public legal materials. Provider DPA and transfer terms, including applicable safeguards described by Clerk. | |
| Stripe | Checkout, subscription billing, invoicing, tax/VAT records, and payment notices. | Billing profile data, payment and subscription metadata, invoices, tax IDs, and payment status. | Provider infrastructure and subprocessors as described in Stripe's public legal materials. Stripe DPA and service-provider terms, including applicable transfer safeguards. | |
| Vercel | Application hosting, serverless functions, cron jobs, and private Blob storage. | Application traffic metadata, logs needed to operate the service, support attachment blobs, and hosted application data. | Provider infrastructure and account/project configuration. Dualhook does not claim exclusive EU-region hosting. Vercel DPA and subprocessors, including applicable transfer safeguards. | |
| Turso / libSQL | Managed database hosting for Dualhook application data. | Account, organization, connection configuration, billing metadata mirrors, webhook metadata, health checks, audit logs, and support metadata. | Database region and account terms depend on the active Turso project and plan. Confirm the production project region and DPA availability in the Turso account before procurement use. Provider trust and subprocessor materials where available; account-specific DPA status must be confirmed with Turso. | |
| Umami Cloud | Privacy-focused website and product analytics. | Page views, basic session/device metadata, and for authenticated dashboard sessions a pseudonymous Clerk user ID and limited role metadata. | Provider infrastructure and account configuration. Dualhook does not send names, email addresses, phone numbers, or WhatsApp message content to Umami. Umami DPA and privacy terms, including applicable transfer safeguards. | |
| Resend | Transactional and administrative email delivery. | Recipient email addresses, message content, delivery metadata, and related email logs. | Provider infrastructure and subprocessors as described in Resend's public legal materials. Resend DPA and subprocessor terms, including applicable transfer safeguards. |
3. Customer-Selected Integrations
Meta / WhatsApp Graph API
Customer-selected platform integration used to configure WhatsApp Business assets and route message-path webhooks.
Meta / WhatsApp is not listed as a Dualhook subprocessor for customer content in the standard Webhook Override flow. Customers choose and control their WhatsApp Business Account, Meta assets, end-user notices, opt-ins, and downstream message handling.