Sub-processors

Last updated: 20 August 2026

This page lists every third party WARMAI LIMITED engages to process customer or visitor data on our behalf. This is the complete and current list. Identification providers are named individually below and this page is updated whenever provider composition changes.

Want to be notified before this list changes? Email compliance@getwarmai.com and we'll add you to our sub-processor change-notification list. We'll give 30 days' notice before adding a new sub-processor that processes personal data on your behalf.

Production sub-processors

Sub-processorPurposeData processedLocationDPA / Privacy
Supabase, Inc.Database, authentication, edge functions (our application backend)All customer + visitor data (sessions, identifications, account state)EU region (Ireland, AWS eu-west-1)Privacy · DPA
WARMAI LIMITED (menoinfra.com)Tracker script delivery and beacon ingestion. The tracker is served from cdn.menoinfra.com and beacons are received at t.menoinfra.com.Visitor IP, user-agent, page view events, session token107 Highfield Lane, Oving, Chichester, PO20 2NNWebsite
IPinfo.io (IPinfo LLC)IP to company resolution, part of the company-level identification waterfallVisitor IPUnited StatesPrivacy · DPA
ipapi.isIP to company resolution and IP classification, part of the company-level identification waterfallVisitor IPGermany (EU)Privacy
Cloudflare, Inc.DNS, CDN, edge compute (Workers), R2 object storageEdge traffic, tracker delivery, asset hostingEU edge nodes preferredPrivacy · DPA
Vercel, Inc.App + docs site hostingApplication traffic logsEU/USPrivacy · DPA
Stripe, Inc.Subscription billing + payment processingCustomer billing details only (we never see card numbers)EU + USPrivacy · DPA
Mandrill (Intuit Mailchimp)Transactional email deliveryCustomer email address + email contentUSPrivacy · DPA
Retention.com, Inc. (RB2B)US person-level visitor identification (white-label OEM). Geofenced to US visitors only — non-US visitors are not processed by this sub-processor.US-located visitor IP, browser metadata; LinkedIn URL + name + title + business email returned on matchUSGDPR · DPA · Sub-processors · CCPA opt-out
Snitcher B.V.Company-level identification (white-label "Radar" product, proxied via radar.warmai.uk so visitors see only a Warm AI domain)Visitor IP, browser metadata; company name + firmographics returned on matchEU (Netherlands)Privacy
Rewardful Inc.Affiliate program tracking (only for visitors who arrive via an affiliate link)Referral cookie identifier, customer email at conversionUSPrivacy

What we don't do

  • We do not sell or share visitor data with third parties for advertising or marketing purposes.
  • We do not enrich visitor profiles via data brokers beyond the sub-processors listed above.
  • We do not transfer personal data to jurisdictions outside the EEA / UK / US without appropriate safeguards (Standard Contractual Clauses or adequacy decisions).

Conditional sub-processors

The following are engaged only when a customer opts into a specific feature:

Sub-processorTriggered byPurpose
CANDDi Group LtdCustomer enables CANDDi waterfall in their account settingsUK-focused IP-to-company identification (filling RB2B's UK coverage gap)

To confirm whether your account has triggered a conditional sub-processor, email compliance@getwarmai.com. We reply within 48 hours.

Sub-processor change policy

When we add a new sub-processor that processes personal data on behalf of customers:

  1. We'll update this page with the new entry and bump the "Last updated" date above.
  2. We'll email customers on the notification list at least 30 days before the new sub-processor goes live, unless the change is urgent for security or service-continuity reasons.
  3. Customers may object to a new sub-processor within 30 days. If we can't accommodate the objection by removing the sub-processor or providing an alternative, the customer may terminate the affected service.

← Back to Home