1Our subprocessors
Each is bound by obligations that match the Data Processing Addendum where they handle an operator’s consumer data, and each receives only what its function needs. We do not publish vendors’ own contract terms here, and we do not claim a vendor holds any certification. “Where used” says whether it is the marketing site, the app, or both.
| Vendor | What it does for us | Data it receives | Where used |
|---|---|---|---|
| Vercel | Hosting, edge network, server logs; Web Analytics (cookieless page-view counts) on the marketing site; domain provisioning for workspaces | Request data (IP address, browser, URL) in transit and in logs; anonymous page-view counts | Site and app |
| Supabase | Database, sign-in and file storage | Operator accounts, signup and lead records, consent log, and (in the app) all workspace data at rest | Site and app |
| Stripe | Payment processing and subscriptions for every SCAIL fee; hosted checkout | Name, email, plan, payment-method details (entered with Stripe, never on our servers) | Site and app |
| Resend | Email delivery (signup and onboarding emails) | Recipient email address and message contents | Site and app |
| Anthropic | AI drafting, analysis and the Halo assistant | In the app: the text a user submits to Halo and credit-file content needed for the answer. Not used on the marketing site. | App |
| Twilio | Text-message delivery and telephony | Recipient phone number and message contents | Site and app |
| Sendblue | iMessage / SMS delivery | Recipient phone number and message contents | App |
| Lob | Printing, certified-mail dispatch and tracking of letters | Letter contents, consumer name and mailing address | App |
| LetterStream | Print and mail (alternate mail provider) | Letter contents, consumer name and mailing address | App |
| PDFShift | PDF rendering of letters and analyses | Document contents at render time | App |
| Documo | Fax delivery, where an operator uses it | Fax document contents and destination number | App |
| Calendly | Demo and consultation booking; booking webhooks where an operator connects it | Name, email and booking details of people who book. On the marketing site it is a link only; nothing from Calendly loads on our pages. | Site and app |
| ElevenLabs | Voice synthesis for Halo's spoken lines | The fixed line of text to be spoken (homepage lines), or text an operator submits for narration in the app. Visitors' browsers do not contact ElevenLabs; our server calls it and serves the audio from scailapp.com. | Site and app |
| Meta Platforms | Measurement of SCAIL's own Facebook and Instagram ads (Meta Pixel and Conversions API) | Page views and signup events with hashed email and phone, click ids, plan and amount. Off for Global Privacy Control, scail_noads, "Reject optional" and (until accepted) the EU, EEA and UK. | Site |
| ManyChat | Instagram direct-message automation that sends a free resource when someone comments a keyword on a SCAIL post | Instagram handle, the keyword and the message thread. [TO CONFIRM: configured inside ManyChat and Instagram, not in this code] | Site |
| ConsumerDirect / SmartCredit | Credit-report retrieval, only where an operator enables it | Consumer identifiers needed to pull a report | App |
| Calendar, Gmail and Places integrations, only where an operator connects them | Calendar and mail data the operator authorizes; address look-ups | App | |
| Microsoft | Outlook mail and calendar integration, only where an operator connects it | Mail and calendar data the operator authorizes | App |
| Expo | Push notifications for the mobile app | Device push token and notification text | App |
Vendors marked “only where an operator enables it” receive nothing unless that feature is switched on in the workspace. We give notice of a new subprocessor that handles consumer data as the DPA provides.
2Services an operator connects itself
These are chosen and configured by the operator for its own workspace and clients. They are the operator’s vendors, not ours.
- Payment gateways an operator uses to bill its own clients: NMI (secure.nmi.com), Authorize.net (api.authorize.net) and USAePay (secure.usaepay.com).
- Credit-monitoring providers an operator's clients use: SmartCredit, IdentityIQ, MyScoreIQ and MyFreeScoreNow (links and stored-login handoffs).
3Linked, not processing
- YouTube (Google LLC): a footer link to youtube.com/@scailapp. No video is embedded, so nothing loads from YouTube until a visitor clicks.
- Instagram, LinkedIn and Skool: footer links only.
4Removed
- Google Fonts (fonts.googleapis.com, fonts.gstatic.com). Removed 2026-10-29: the marketing site and its email shell now serve Urbanist from scailapp.com.
5Questions
legal@scailapp.com. Browser-side items are listed in the Cookie Policy.