Third-party service providers Elective Labs engages to operate the platform. We give 30 days' advance notice before adding or removing any subprocessor.
GDPR / UK-GDPR transparency
For EU and UK-based customers, this list satisfies the subprocessor-disclosure requirement in our Data Processing Agreement (DPA). Transfer mechanisms are disclosed per Schrems II (CJEU 2020) Transfer Impact Assessment expectations. Major subprocessors are certified under the 2023 EU-US Data Privacy Framework; the remainder rely on the 2021 Standard Contractual Clauses.
| Subprocessor | Purpose | Data scope | Region | Transfer mechanism |
|---|---|---|---|---|
| Firebase / Google Cloud (Firestore, Cloud Storage, Auth) | Primary database, object storage, user authentication | Campaign data, donor PII, uploaded documents, user accounts | US (us-central1) | EU-US Data Privacy Framework (Google certified) |
| Vercel | Application hosting, edge network, CI/CD for the platform | HTTP request metadata, deployment logs. No persistent user data. | US / Global edge | EU-US Data Privacy Framework (Vercel certified) + 2021 Standard Contractual Clauses |
| Anthropic (Claude API) | AI language model powering agent skills (Mia, Connor, Arlo, etc.) | User prompts, agent outputs. Anthropic does not train on API data under enterprise terms. | US | 2021 Standard Contractual Clauses (enterprise agreement) |
| Stripe | Subscription billing, payment processing, Stripe Connect for campaign payouts | Campaign billing info, payment method tokens, payout bank details | US / Global | EU-US Data Privacy Framework (Stripe certified) |
| SendGrid (Twilio) | Transactional email, marketing email dispatch | Recipient email, send metadata, bounce/open/click events | US | 2021 Standard Contractual Clauses |
| Twilio (Programmable Messaging) | SMS dispatch, inbound SMS handling (STOP/UNSUBSCRIBE) | Recipient phone, message body, delivery status | US | 2021 Standard Contractual Clauses |
| ActBlue | Political fundraising processor (Democratic-aligned campaigns) | Donor PII, contribution amount, donor address (per FEC disclosure rules) | US | US-only processing; no EU transfers |
| WinRed | Political fundraising processor (Republican-aligned campaigns) | Donor PII, contribution amount, donor address (per FEC disclosure rules) | US | US-only processing; no EU transfers |
| Cal.com | Demo booking scheduler | Prospect email, meeting time | US / EU | Open-source self-hostable + EU-US Data Privacy Framework (managed tier) |
| Instantly.ai | Cold-email outreach (platform-side lead generation only; not customer sends) | Prospect email, campaign performance metrics | US | 2021 Standard Contractual Clauses |
| Plausible Analytics | Cookieless web analytics on the public marketing site | IP-hashed pageview metadata, no cookies, no personal data | EU (Germany) | EU-hosted; no cross-border transfer for EU visitors |
| OpenStates | Legislative data (bills, officeholders) for officeholder dashboard | Public-record legislative metadata only | US | Public data; no personal data transferred |
We publish additions to this list at least 30 days before a new subprocessor begins processing customer data. Customers with an active Data Processing Agreement may object to a new subprocessor within that window; we will work in good faith to provide an alternative or permit the customer to terminate the affected service without penalty.
Last updated: July 19, 2026.
Questions about a subprocessor? Contact us · Data Processing Agreement · State Coverage