Sub-processors
Last updated: 21 October 2026
Sonara Media AS engages the third-party service providers (“sub-processors”) below to help deliver our services. Each is bound by data processing terms compatible with the GDPR. Providers marked “customer-activated” only receive data when a customer enables that feature or connects their own account/API key — data flows to them at the customer’s direction.
Core infrastructure
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Supabase | Database and authentication | All customer and prospect data, account credentials | EU (Ireland, AWS eu-west-1) |
| Vercel | Application hosting and delivery; file storage for uploaded and generated media | Application traffic and logs; images and clips a customer uploads or makes | EU (Dublin) for the application; global edge network; US company |
| Inngest | Background jobs (sending, syncing, research queues) | Job events carrying record identifiers, never message content | USA |
| Upstash | Rate limiting (abuse and cost protection) | Rate-limit counters keyed on organisation or IP | EU / USA (region-selected) |
| Cloudflare (Turnstile) | Bot check on public forms | Browser signals for the check, IP address | EU / USA |
| Sentrycustomer-activated | Error monitoring | Diagnostic and error data | USA |
Communication
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Resend | Transactional e-mail (invitations, account mail) and replies; never cold outreach | E-mail content, recipient address | USA |
| Google (Gmail and Calendar)customer-activated | Bring-your-own-mailbox send and reply sync; meeting invitations and availability | E-mail content, calendar events, attendee addresses | USA / EU |
| Microsoft 365 (Outlook and Calendar)customer-activated | Bring-your-own-mailbox send and reply sync | E-mail content, calendar events | EU / USA |
| Twiliocustomer-activated | SMS and WhatsApp messaging | Message content, phone number | USA |
AI processing
AI providers receive prompt content to generate or classify text. Customer Data is never used to train their models; prompts and answers are not logged by Sonara. Before any call to a provider in China, names and contact details are masked or replaced by placeholders, and tasks that need personal data (inbox classification, reply suggestions, chat) never go there.
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| OpenAI | AI drafting, research synthesis, classification, strategy, embeddings | Prompt content (drafts, research inputs, conversation text for the tasks that need it) | USA |
| DeepSeek | AI synthesis of company research | Company research with contact details masked; no account data | China (PRC), under SCCsmasked data only |
| Z.ai (GLM) | Routine AI tasks: fact-checking drafts, shaping social posts, sharpening text, review replies, SEO and marketing notes, performance notes | Pseudonymised prompt content (names replaced by placeholders); no account data | China (PRC), under SCCsmasked data only |
| Higgsfieldcustomer-activated | Generating pictures and clips for social posts | The creative prompt (brand, product, scene — never personal data), reference pictures the customer uploads | USA |
| KIE (NexusAI Services LLC)customer-activated | Generating pictures and clips for social posts through resold image and video models | The creative prompt (brand, product, scene — never personal data), reference pictures the customer uploads | USA |
Visitor Intelligence (the customer’s own website)
A customer may place Sonara’s page-view script on its website. The script stores nothing on the visitor’s device. Sonara reads the visitor’s IP address for seconds, turns it into a pseudonymous identifier that changes every day, and asks one provider which company the address belongs to. Only the company name is kept; the address itself is never stored, and the lookup cache holds a one-way hash for seven days.
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Leadfeeder (Dealfront Group GmbH)customer-activated | Resolving a visiting IP address to a company name | IP address (sent), company name, domain, size, industry and country (returned) | Germany (EU) |
Our public website: analytics and advertising
sonara-media.com only, never the platform. Nothing runs until a visitor accepts the cookie banner: Google Analytics loads in a consent-denied mode that stores nothing, and the Meta pixel and the Leadfeeder tracker are not loaded at all. Google’s advertising and personalisation features are disabled and IP addresses are anonymised. Our own cookieless page-view script (described above) runs on our site too.
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Google Analyticscustomer-activated | Public website traffic measurement | Page views, referrer, approximate location (anonymised IP) | USA / EU |
| Meta Platforms (pixel)customer-activated | Advertising measurement and audiences | Page views, referrer, IP address, browser identifiers | USA / EU |
| Leadfeeder trackercustomer-activated | Identifying which companies visit our public website | Page views, referrer, IP address, browser identifiers | Germany (EU) |
Company data, enrichment and research
Used when a customer generates leads, researches a company or runs a check. Data sent is the company identifier (name, organisation number, website, public LinkedIn URL) and, for the contact lookups named below, a person’s name together with their company.
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Fisioncustomer-activated | Norwegian company register and contact lookup for lead generation | Search filters; returns company data and the register’s named roles with business contact details | Norway |
| CompanyData.comcustomer-activated | Official company-register data for countries outside Norway (Croatia first) for lead generation | Search filters (country, city, industry text); returns company register facts and the business contact the register holds | EU (to be confirmed with the vendor before the first customer outside Sonara uses it) |
| Brønnøysundregistrene (BRREG)customer-activated | Norwegian company register lookup | Company name / organisation number | Norway (public data) |
| Serpercustomer-activated | Web search for company research, news, reviews and LinkedIn profile lookup | Search queries: company name; for a profile lookup, a contact’s name with the company | USA |
| Bright Datacustomer-activated | Public LinkedIn data: company pages (followers, posts) and a people directory (name, position, city, employer) | Company LinkedIn URL or domain; a person’s name with the company for the directory search | Israel / USA / EU |
| Firecrawlcustomer-activated | Reading public web pages (a company’s own site, a prospect’s site) for research | Public page URL and its text | USA |
| Brandfetchcustomer-activated | Company logos | Company domain | USA |
| Google (Places, PageSpeed, YouTube Data)customer-activated | Public reviews, website performance scoring, public video statistics | Company name or public URL | USA |
| Apifycustomer-activated | Public social-media post statistics for the Trends module | Public post URLs | Czech Republic (EU) |
| DataForSEOcustomer-activated | Keyword and ranking data for SEO checks | Public website domain and keywords | USA |
| Apollocustomer-activated | Contact discovery (customer’s own key) | Prospect name, company, domain | USA |
| Crunchbasecustomer-activated | Company and funding intelligence (customer’s own key) | Company name / domain | USA |
| BuiltWithcustomer-activated | Website technology detection | Company domain | USA |
| Phantombustercustomer-activated | LinkedIn data collection (customer’s own key) | Public LinkedIn data | France (EU) |
| Meta Platforms (Ad Library)customer-activated | Public advertising transparency data | Company name | USA / EU |
Publishing (the customer connects its own accounts)
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| LinkedIncustomer-activated | Publishing posts | Post text and media, account token | USA / EU |
| Meta Platforms (Facebook and Instagram)customer-activated | Publishing posts and reading their statistics | Post text and media, page token | USA / EU |
| TikTokcustomer-activated | Publishing clips and reading their statistics | Clip and caption, account token | USA / EU / Singapore |
| PostPulsecustomer-activated | Publishing to several networks through one connection | Post text and media, account tokens | EU |
CRM and accounting (the customer connects its own system)
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| HubSpot, Pipedrive, Attio, Close, Copper, monday.com, Salesflare, Zendesk Sellcustomer-activated | CRM synchronisation | Contacts, companies, deals the customer chooses to sync | USA / EU |
| PowerOffice, Fiken, Tripletex, 24SevenOffice, Vismacustomer-activated | Orders and invoices in the customer’s accounting system | Customer company, order lines, invoice status | Norway / EU |
International transfers
Some sub-processors are located outside the European Economic Area (EEA), including the United States. Where personal data is transferred outside the EEA, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (SCCs) and supplementary measures where required.
Changes to this list
We will update this page when we add or replace a sub-processor. Customers may subscribe to change notifications by emailing fabian@sonara-media.com. We aim to notify customers of material changes before they take effect.
This list is provided for transparency and should be reviewed by qualified legal counsel as part of your data processing agreement. It does not constitute legal advice.