Subprocessors
Last updated: October 6, 2026
Clevers LLC uses the companies below to provide HEYTOUR. Each processes personal data only on our instructions, under a written contract with data protection terms (including the Standard Contractual Clauses where data leaves the EEA or UK), and only for the purpose listed. See our Privacy Policy for how we handle personal data.
Infrastructure
| Subprocessor | Purpose | Data | Location |
|---|---|---|---|
| Google Cloud (Google LLC) | Hosting, database, file storage, content delivery, background jobs and backups | All Service data: account and sign-in data, workspace content, notifications, logs | United States (Google Cloud us-central1, Iowa; files in Google Cloud's US multi-region) |
| Google Firebase Cloud Messaging (Google LLC) | Push notifications to the mobile apps (iPhones through Apple's push service) | Push token, notification title and link | United States and other countries where Google operates |
Communications
| Subprocessor | Purpose | Data | Location |
|---|---|---|---|
| Mailgun (Mailgun Technologies, Inc.) | Email: sign-in codes, invitations, security notices and notifications | Email address, name, message content | United States |
| Twilio (Twilio Inc.) | Text messages: sign-in codes, and security notices for people who use only a phone number | Phone number, message content | United States |
AI
Used only when you or your workspace use an AI feature. We use their paid business APIs, under terms that don't allow them to train models on what we send.
| Subprocessor | Purpose | Data | Location |
|---|---|---|---|
| Anthropic (Anthropic, PBC) | AI features (Claude models) | Prompts and the workspace content a feature needs; outputs | United States |
| OpenAI (OpenAI, L.L.C.) | AI features (OpenAI models) | Prompts and the workspace content a feature needs; outputs | United States |
| Google (Google LLC) | AI features (Gemini models, through Google Cloud Vertex AI) | Prompts and the workspace content a feature needs; outputs | United States (Google Cloud us-central1) |
Sign-in providers
Used only if you choose to sign in with them. Each is also a controller of the account you have with it, under its own privacy policy.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Apple (Apple Inc.) | Sign in with Apple, and revoking our access when you delete your account | Apple account identifier, name (first sign-in only), email or relay address | United States |
| Google (Google LLC) | Sign in with Google | Google account identifier, name, email | United States |
| Microsoft (Microsoft Corporation) | Sign in with Microsoft | Microsoft account identifier, name, email | United States |
Your organization's own identity provider, if it uses single sign-on, is chosen and contracted by your organization, not by us.
Changes to this list
When we plan to add or replace a subprocessor, we'll update this page and change the date at the top at least [30 days] before the new subprocessor starts processing personal data. Workspace owners and admins can subscribe to updates by writing to privacy@heytour.ai, and customers with a data processing agreement are notified as that agreement sets out. If you object to a new subprocessor on reasonable data protection grounds, tell us at privacy@heytour.ai within that period and we'll work with you to find a solution.