This is the central list of providers used by Simply Invent Labs LLC to operate Simply Send, with their functions and applicable data-processing roles. Our Data Processing Addendum (DPA) and Privacy Policy refer to this page.
A provider's role depends on the actual data, purpose, and service used. Customer Data and Subprocessor have the meanings given in the DPA. The customer's completed processing record identifies the applicable contracting entities, services, processing and support-access countries, and retention settings. A listed optional service applies only when specifically agreed or enabled; selecting a sending region does not localize every provider or data flow.
1. Service Subprocessors
These providers may Process Customer Data on the customer's behalf for the applicable Service. The DPA's authorization, contractual safeguards, change notices, and international-transfer requirements apply. The list is limited by the services and locations recorded for the customer; it does not authorize undisclosed services or optional AI processing.
| Subprocessor | Service and Processing | Location |
|---|---|---|
| Amazon Web Services (AWS) | Cloud infrastructure, storage, compute, event processing, and email delivery through Amazon SES. | The selected account region, including US East (Northern Virginia) or Frankfurt where offered, for regional identity, account, workspace, domain, storage, compute and email services. The applicable Service configuration identifies the workloads and region. Separately disclosed provider and SMTP processing is not localized by this selection. |
| Oracle Cloud Infrastructure (OCI) | Email delivery, related delivery-event processing, and infrastructure for the Simply Send SMTP bridge where used. | US or Frankfurt for the applicable supported delivery route, as identified in the Service configuration. The current Simply Send SMTP bridge is US-hosted, including when forwarding to Frankfurt delivery workflows. SMTP transit, temporary attachment processing, and potentially personal operational metadata are described in DPA Annex 1.B. Other processing and international support access remain subject to the DPA safeguards. |
| Cloudflare | Content delivery, traffic security, and technical request metadata processing. | Global network locations, including the United States. |
| Zoho | Customer support ticketing and live chat; contact details and information Customer chooses to include in a support request. | United States for the currently configured Simply Send service. Any additional support-access country must be disclosed and authorized before the affected Processing. |
| Telnyx | Only for communications services specifically agreed in an order or enabled feature disclosure. Depending on that service, data may include email or phone identifiers, message or call content, delivery metadata, and, for separately enabled AI, audio, transcripts, prompts, and outputs. This listing does not represent that all these channels or AI features are currently offered or enabled. | Telnyx identifies primary processing facilities in the United States. The permitted service, region, and any additional processing or support countries must be specified in the applicable processing record before use. |
| OpenAI (API) | AI template creation when a user requests it; prompts, instructions, and template content submitted or selected for generation or refinement. | United States for the active OpenAI API service. An email sending region does not change this location. Applicable retention and data-use controls must be established under the active account terms. |
| Google (Gemini API) | Email content safety review. The Service locally redacts direct identifiers, known Google-imported contact values, recipient-specific URLs and embedded data before external review and withholds the request if sanitization fails. Any remaining Personal Data remains subject to this DPA. | United States for the active Gemini API service. No EEA-only processing is promised by selecting a sending region. Applicable retention and data-use controls must be established under the active account terms. |
| Slack (where Customer Data is used for support or operations) | Necessary support or operational communications containing Customer Data, limited to the information needed to resolve the issue. Internal employee communications and independent sign-in processing have a separate role. | United States for the currently configured Slack service. Any additional support-access country must be disclosed and authorized before the affected Processing. |
2. Account, Billing, and Analytics
These activities generally support Simply Send's own account, billing, identity, or website operations, as described in the Privacy Policy and Cookie Policy. If a provider instead Processes Customer Data on the customer's behalf, the DPA's safeguards apply to that Processing regardless of the provider's label.
- Stripe: Payment processing, billing, subscriptions, and usage records. Payment details are handled under Stripe's applicable terms; Simply Send does not store full payment-card details.
- Slack: Internal team communications, operational alerts, and federated sign-in when selected. Necessary support or operational communications containing Customer Data are subject to the subprocessing safeguards above.
- Google Analytics: Website and application usage reporting, including pages visited and interaction data, subject to the user's analytics-consent preference. Cookie and technical identifiers may remain Personal Data even when reports are aggregated.
- Microsoft Clarity: Website and application interaction analytics, including session behavior and heatmaps, subject to analytics consent and configured masking. Session data is not necessarily anonymous.
- Marketplace purchase channels: AWS Marketplace, Microsoft Azure Marketplace, Google Cloud Marketplace, and the Shopify App Store or another Shopify purchase channel, when available, handle transactions under their terms. Simply Send receives subscription, entitlement, account-linking, and procurement information needed to provision and support the subscription.
3. Customer-Selected Integrations
Customers may authorize independent services to submit data to Simply Send or receive data and actions from it. The information exchanged depends on the integration, selected workspace, permissions, and configuration. These customer-selected services are not automatically Subprocessors engaged by Simply Send; the actual engagement and Processing determine the role. Simply Send remains responsible for its own Processing and for providers it engages on the customer's behalf.
- Google Workspace: Selected Google Contacts, Sheets, or Forms data is read for one-way contact imports into the chosen subscription group. Access is read-only and does not use Gmail as the sending path. The Privacy Policy explains the data, disconnection, and Google Limited Use restrictions.
- Supabase: When authorized, the integration uses Supabase's Management API to identify projects and configure the selected project's authentication email settings with Simply Send SMTP connection details and credentials. OAuth tokens and project or connection metadata support setup and connection management. Authentication emails subsequently submitted through that SMTP connection are processed by Simply Send. This setup does not itself import the customer's entire Supabase database.
- WordPress: A customer-installed Simply Send plugin submits the sender, recipients, subject, message body, applicable headers, and selected attachments for email delivery through Simply Send. WordPress is software; the customer's hosting provider and other installed plugins may separately process site or email data. A WordPress plugin connection does not by itself make WordPress.org, Automattic, or every installed plugin a Simply Send Subprocessor.
- Zapier, Shopify, and customer-selected webhooks: Sending requests, selected source or contact data, and event payloads are exchanged according to the enabled trigger, action, application, or destination. The customer controls the connected account and destination.
- MCP and external AI clients: Model Context Protocol (MCP) is a connection protocol, not a separate provider. A customer-authorized client, including an AI assistant, can submit tool arguments, receive tool results, and request permitted actions within the authorized workspace, access scopes, and workspace role. Results can contain contact details, email previews or content, and operational information depending on the permitted tool. The client operator, model provider, or connected services may process the information they receive under the customer's arrangements. This is a separate data flow from Simply Send's own OpenAI and Gemini API functions listed above.
Review the requested permissions and the connected provider's current privacy, retention, AI-use, transfer, and subprocessor terms before authorizing a connection. An integration permission is not general permission to disclose unrelated data or override Google Workspace Limited Use restrictions. A marketing link to an external AI service does not itself establish an API integration or authorize account access.
Disconnect or revoke a connection using the available Simply Send and provider controls, and disable any remaining plugin, webhook, or API/SMTP credential separately where applicable. Disconnection does not automatically erase previously imported contacts, sent messages, logs, or copies independently retained by the external service; applicable retention and deletion procedures still apply. Removing an OAuth connection does not necessarily revoke separately issued credentials.
We maintain the identities and applicable processing details for providers we engage, with the DPA's safeguards for onward subprocessing. A customer-selected provider maintains its own onward-provider disclosures under its relationship with the customer. A link to a provider's changing subprocessor list is not blanket authorization for Simply Send to engage every provider on that list.
4. Login and Identity Providers
The sign-in options offered by Simply Send include Google, Microsoft, Amazon, GitLab, LinkedIn, and Slack. When you select a provider, authentication exchanges can include your provider account identifier, email address and verification status, name, profile information made available under the requested permissions, and authentication tokens or assertions. We use the returned identity information to authenticate you, associate the identity with your Simply Send account, and protect account access. The provider receives the authentication request and associated technical information and handles its own account and security activities under its terms.
Selecting a login provider does not grant it access to your message content, contacts, or workspace tools. Additional integration access requires its own authorization. Provider sign-in roles differ from AWS's operation of Simply Send's authentication infrastructure and from any separate support or API service provided by the same company. The Privacy Policy describes identity data and account controls.
5. Optional AI Services
Before an optional Telnyx AI feature Processes Customer Data, its feature, upstream model providers, data categories, retention, and processing countries must be identified in the applicable documented instructions and authorized under DPA Section 4. Telnyx's AI Subprocessor list is an informational source; linking to it does not authorize every listed provider. The selected configuration must comply with the DPA's purpose, transfer, and no-training restrictions.
6. Updates and Contact
The DPA governs authorization of new or replacement Subprocessors, including its 30-day email-notice and objection procedure. Updating this page does not waive those requirements or authorize a change that has not completed that procedure. The applicable list and any service-specific details should be retained with the parties' incorporated Agreement and provider records.
For provider details, processing locations, or a DPA/SCC completion record, contact [email protected].