Service providers
Customer subprocessors
The DPA applies where these services process personal data on your behalf.
Amazon Web Services — Amazon Web Services EMEA SARL
Hosting, storage, authentication (including Cognito) and infrastructure. Data includes account identifiers, customer content and operational records. Hosting: US East (Northern Virginia), United States.
Microsoft — Microsoft Ireland Operations Ltd
- Azure: AI processing and document analysis involving prompts, excerpts, attachments, tool results and documents. Resources: East US, United States. AI inference: global, including outside the US.
- Microsoft 365: Enquiry, support, privacy and security correspondence, including contact details, messages, attachments and metadata. Mailbox storage: United Kingdom.
Exa — Exa Labs Inc.
Web search involving generated queries and API request metadata. Queries may include prompts or information from customer content. Exa is US-based. Privacy policy.
Other service providers
- Amplitude — Amplitude, Inc.: Basic website traffic statistics and, with consent, detailed analytics and session replay. Basic statistics include homepage addresses and visits, source categories, country and connection information. Detailed analytics also includes browser identifiers, page addresses, device information, interactions and page recordings. Processing uses Amplitude's US region. Data Processing Agreement · Privacy information.
- Google: Optional sign-in supplies your name, email and account identifier. The Excel add-in separately loads Google fonts. Login and font requests involve browser/network information. Privacy policy.
- Stripe: Billing and customer-portal services involving billing contacts, customer/transaction identifiers and payment details. Stripe acts as processor and independent controller for payment administration. Our data-processing counterparty is Stripe Payments Europe, Limited. Its DPA describes US transfers and other international processing.
- Fillout — Restly, Inc., d.b.a. Zite: Optional initial sales enquiry form, involving submitted information and browser/network data. Privacy policy · Provider list.
Provider changes
We will email affected customers at least 14 calendar days before a new or replacement customer subprocessor begins processing and update this register. Longer notice required by law or binding transfer clauses applies. The DPA sets out notice details and the objection process; send reasonable data-protection objections to inquiries@finbar.com during the notice period.
See our privacy notice for transfer safeguards and information requests.