Legal
Subprocessors
Last updated: September 26, 2026
Atomic Reps uses the 9 companies below to process personal data on its behalf. For each one, the table says what it does for us, which personal data it receives, where it processes that data, and the safeguard that covers any transfer outside the European Economic Area. The same list is Annex III of our Data Processing Agreement and appears in our Privacy Policy.
Companies that process data for us
| Company | What it does | Personal data | Location | Transfer safeguard |
|---|---|---|---|---|
| Clerk Inc. clerk.com | Sign-in and account management. | Name, email address, profile photo, organization memberships, session tokens and sign-in metadata. | United States. | EU-US Data Privacy Framework, with the EU Standard Contractual Clauses as the fallback. |
| Convex Inc. convex.dev | Application database and server functions. | All application data: accounts, answers, scores, practice settings, organization settings, Slack integration state, class data, audit logs and cached Slack profile photos. | EU West (Ireland). Convex Inc. is a US company. | Storage and compute stay in the EU; the EU Standard Contractual Clauses (Module 3) cover vendor support access from the United States. |
| Cloudflare Inc. cloudflare.com | Website hosting, content delivery, cookieless aggregate traffic measurement, and storage for a weekly backup copy of the application database. | IP addresses and request metadata (headers, URLs, timestamps); a weekly copy of the database tables, stored in Cloudflare's EU jurisdiction. | United States and a global edge network with EU points of presence; the database backup is stored in the EU. | EU Standard Contractual Clauses (Module 3). |
| Slack Technologies LLC slack.com | Delivers daily reps and commands in Slack workspaces that install the app. | Slack user IDs, workspace IDs, display names, email addresses, profile photos, channel IDs, message timestamps and button presses. | United States. | EU-US Data Privacy Framework (certified through Salesforce, Inc.). |
| PostHog Inc. posthog.com | Product analytics, crash reporting, and session replay on public marketing pages, loaded only after consent; plus anonymous page-visit events and pseudonymous product events sent from our servers. | Page views and feature usage; after consent on the web, a signed-in user's name, email address and organization name; a one-way daily fingerprint on anonymous page visits; a pseudonymous account identifier on server-side product events. | EU (Frankfurt). | None needed: the project is hosted in the EU (eu.posthog.com). |
| Resend Inc. resend.com | Sends transactional and marketing email. | Email addresses, email subject and body, and delivery, bounce and complaint events. | United States. | EU Standard Contractual Clauses incorporated in Resend's Data Processing Agreement. |
| Add Rabbit LLC (Purelymail) purelymail.com | Receives and stores email sent to atomicreps.com addresses, including support@ and privacy@. | The email you send us: your email address, your name if you include it, and the message and any attachments. | United States (Amazon Web Services, us-east-1, Virginia). | EU Standard Contractual Clauses. |
| RevenueCat, Inc. revenuecat.com | Records the status of plans bought in the iPhone app. | Your account identifier, the vendor identifier iOS assigns to the app on your device, and Apple's purchase records (product, dates, renewal state). Never your name, email address or payment card. | United States. | EU Standard Contractual Clauses (Modules 2 and 3) with the UK addendum and the Swiss adaptation, in paragraph 11 of RevenueCat's Data Processing Addendum. |
| Polar Software Inc. polar.sh | Checkout, tax and subscription billing on the web as Merchant of Record; Polar uses Stripe, Inc. for payment cards. | Email address, billing contact details, subscription status and plan, and invoice history. Card details go to Stripe and never reach us. | United States. | EU Standard Contractual Clauses that Polar has entered into; Stripe is certified under the EU-US Data Privacy Framework. |
Companies that receive data in their own right
These companies receive personal data as independent controllers. They decide how to use it under their own privacy policies, and they are not our subprocessors.
- Apple Inc. (apple.com) - Distributes the iPhone app through the App Store and TestFlight, and takes payment for plans bought in the app. Data: Download, install and purchase records, payment details, and, only if you turn on sharing with app developers in your iPhone's settings, crash logs and aggregate usage figures.
How we tell you about changes
Before we add or replace a subprocessor, we update this page and give at least 30 days' written notice, as clause 7 of our Data Processing Agreement requires. To receive those notices by email, write to privacy@atomicreps.com. An organization that objects to a new subprocessor on data protection grounds can tell us in writing within the 30 days. We then work with the organization to resolve the objection; if we cannot, the organization may terminate the affected part of the service.
See also: Privacy Policy · Data Processing Agreement · Security