01Scope of this list#
A subprocessor is a third party that Unbound Operators LLC ("Unbound") engages to process personal data in order to deliver the service. Colombian law calls this a transmission of data; under Mexican law the provider is a processor and communicating data to it is not a transfer; European law calls it sub-processing.
The list has three groups: (a) infrastructure subprocessors, which process the data you load into your workspace; (b) providers that process only data for which Unbound is the controller, such as the billing of your subscription; and (c) integrations that you decide to connect, which act under your own agreement with that provider and are not Unbound subprocessors.
02Infrastructure subprocessors#
| Provider | Function | Data processed | Location |
|---|---|---|---|
| Supabase, Inc. | Database, authentication and file storage | All workspace content, user accounts and uploaded files | United States (AWS, region us-east-2, Ohio) |
| Vercel Inc. | Hosting of the application and the site, server functions, delivery network, technical request logs and the approximate location its network provides | Data in transit for every request, IP addresses, technical logs | United States, with a global delivery network |
| Resend (Plus Five Five, Inc.) | Transactional email: sign in codes, invitations, notices, invoices and the email campaigns you send | Recipient email address, name and message content, delivery events | United States |
| Browser push notification services (Google, Mozilla, Apple, depending on the browser) | Delivery of push notifications to users who turn them on | Subscription device identifier and the notice text | Depends on the browser vendor |
The legal name of Resend was taken from its public site and must be checked against its data processing agreement before publication. [SEED: confirm Resend legal entity and DPA]
03Providers for data Unbound controls#
| Provider | Function | Data processed | Location |
|---|---|---|---|
| Stripe, Inc. and its affiliates | Billing of the Unbound OS subscription, billing portal, refunds | Name, email, company, card data (processed by Stripe directly; Unbound never receives it), payment history | United States and other countries where Stripe operates |
| Vercel Inc. (Web Analytics) | Aggregated visit statistics for theunboundos.com, without cookies | Page, referrer, approximate country and region, browser, operating system and device type | United States |
| Telegram | Internal notices to the Unbound team about platform operations | Company name, account owner name and the event that triggers the notice | [SEED: confirm the Telegram entity providing the service and its location] |
| [SEED: Unbound corporate email provider for hello@withunbound.com] | Support and privacy request email | Whatever you write in your message | [SEED: location] |
04Integrations you connect#
These integrations run only if a user of your workspace connects them. When they do, data moves between Unbound OS and that provider under the agreement and privacy policy that you or your user accepted with it. Unbound is not responsible for the processing that provider carries out.
| Provider | Used for | What is exchanged |
|---|---|---|
| Google LLC (Google Calendar) | Syncing calendars and creating events for bookings | Events, availability, booking guests |
| Google LLC (Sign in with Google) | Signing in with a Google account, when that option is on | Name, email and profile picture |
| Google LLC (Google Drive) | Syncing deliverable folders shared with the platform service account | File names and metadata in those folders |
| Meta Platforms (Facebook, Instagram, Threads) | Publishing, reading comments and messages and viewing metrics for the accounts you manage | Posts, comments, messages, metrics and public data of the profiles that interact |
| Stripe (your own account) | Card payment of the invoices you issue to your clients | Invoice and payer data. The payment runs on your own Stripe account |
| Telegram (the shared platform bot) | Notices to the team chat or the personal chat a user registers | The notice text, which may include the name or email of a contact and the approximate location of whoever opened a proposal |
| Public providers for the Solana and Tron networks | Checking cryptocurrency payments to addresses you register | Wallet addresses and public transactions |
| The AI model you connect over MCP (for example Claude, ChatGPT or Gemini) | Letting an AI agent read and act in your workspace with the permissions of whoever connected it | Whatever the agent reads or writes. You choose and contract the model provider |
05Platform artificial intelligence#
The platform has code integrations with model providers (Anthropic, OpenAI and NVIDIA) that Unbound uses for its own internal operations. Customer workspaces are created with no platform AI task allowance, so the content of your workspace is not sent to those providers. If that changes, we will update this list and give you the notice described in the next section before any data is sent.
06Changes to the list#
Before adding a new subprocessor that processes your workspace data, we will publish the change on this page and email the owner of each workspace at least 30 days in advance, except for an urgent security or continuity need, in which case we will give notice as soon as possible. You may object to the change on reasonable data protection grounds by writing to hello@withunbound.com. If we cannot find a solution, you may end the subscription and receive a pro rata refund of the prepaid unused period.