Current inventory
This list reflects providers present in the implemented service architecture. A provider processes data only when the relevant feature is enabled and used. The authenticated public service is not yet open; this list will be kept current before account access becomes generally available.
| Provider | Purpose and data | Verified location | Transfer position |
|---|---|---|---|
| Supabase, Inc. | PostgreSQL database, authentication, Data API, private object storage Account, workspace, event, lead, correspondence, research, seller, and service records; private uploads | Selected application deployment region: London, UK | UK adequacy for EEA-to-UK transfer; Supabase DPA and applicable onward-transfer terms |
| Vercel Inc. | Web application hosting, server execution, delivery, and platform logs Web requests, account/session traffic, API payloads routed through the application, and operational logs | Global delivery and provider locations documented by Vercel; no single-region claim | Vercel DPA includes SCC and UK transfer architecture for covered services |
| Stripe Payments Europe, Limited | Subscription checkout, billing, payments, fraud prevention, portal, and signed billing events Billing identity, workspace/customer reference, subscription, seat, payment and transaction information | Ireland/EEA and Stripe's documented global providers and financial partners | Stripe DPA and Data Transfers Addendum; Stripe may also act as independent controller for payment, fraud, and regulatory functions |
| OpenAI Ireland Ltd. | Task-specific AI extraction, transcription, classification, normalization, drafting, and recommendation assistance Only the content and structured context needed for the selected AI task, which may include card images, notes, replies, public research, or authorized seller content | Ireland contracting entity for EEA customers; processing may use OpenAI's documented global infrastructure and subprocessors | OpenAI DPA and SCC framework; account-level retention and transfer configuration applies |
| Nylas, Inc. | Google and Microsoft mailbox authorization, message send/read operations, and signed mailbox/message webhooks Connected mailbox identity, grant metadata, selected outbound/inbound messages, provider thread identifiers, and lifecycle events | Selected service configuration uses Nylas Europe region, London, UK (api.eu.nylas.com) | UK adequacy covers the selected regional store; Nylas DPA and applicable onward-transfer terms |
| API Hero Ltd. (trading as Trigger.dev) | Durable workflow scheduling and bounded execution for sequences, reply handling, research, and seller processing Minimum workflow identifiers and task payload required for the queued job | Trigger.dev documents cloud processing in AWS us-east-1 and additional subprocessor locations | Trigger.dev DPA identifies SCCs and UK transfer safeguards |
| AlphaAI Technologies Inc. d/b/a Tavily | Public-web search used for company research Public-company research queries, URLs, and public search results; no confidential seller documents | United States and provider locations disclosed by Tavily | Contractual and transfer safeguards must be confirmed before this provider processes public customer data |
| SideGuide Technologies, Inc. d/b/a Firecrawl | Public website extraction and an optional confidential-document fallback only when verified zero-data-retention is available Public URLs and extracted public content. Confidential seller documents are blocked unless the account/request has positively verified ZDR | United States/provider infrastructure; exact production processing locations require verification | Contractual and transfer safeguards must be confirmed before public customer processing. Confidential ZDR is not enabled; confidential documents fail closed |
Not currently enabled
ExpoLeadZ does not currently enable a public-site analytics, advertising, behavioral-tracking, error-monitoring, or separate customer-support provider. No such provider is listed merely because it might be useful later. Google and Microsoft are customer-selected connected mailbox services authorized by the customer through Nylas; they are not presented here as LearnDo-appointed general subprocessors.
Changes and objections
Material additions or replacements will be published in accordance with the DPA. A customer may raise a reasonable data-protection objection within the stated notice period by emailing contact@expoleadz.com.