Legal · 05
Subprocessors
Version 1.0 · Effective 4 August 2026
No company our size runs a website, a phone number, a text messaging system and a payment process by itself. We use other companies to do parts of it, and those companies see some of your data. This page names every one of them.
It is split in two because the distinction matters. The first table is the list that our Data Processing Addendum is about: companies that touch your customers' information. The second is companies that touch information about you and other visitors to our own website, which is covered by the Privacy Policy instead.
On this page
1. Companies that touch your customers' data
These are subprocessors under section 7 of the DPA. Each one is engaged under a written agreement at least as protective as the one we have with you, and we stay responsible to you for what they do, to the same extent as if we had done it ourselves.
| Company | What it does for you | What it receives | Where |
|---|---|---|---|
| GoHighLevel (HighLevel Inc. / LeadConnector) |
The CRM behind your service. It holds your contacts, runs the automations, sends the texts, places and records the calls, and powers your inbox and review requests. | Your customers' names, phone numbers, email addresses, message and call history, form submissions, review responses. | United States |
| Twilio (via GoHighLevel) |
Carries the actual phone calls and text messages. Your business number is provisioned through this layer. | Phone numbers, message contents, call metadata, and call recordings where you have enabled them. | United States |
| Mailgun (via GoHighLevel) |
Delivers the emails your system sends, including lead notifications and review requests. | Email addresses and the contents of those emails. | United States |
| Vercel | Hosts and serves your website. | Server logs, including IP addresses and browser type, as a normal part of serving a page. Form submissions in transit. | United States |
| Google (Business Profile, Search Console) |
Where your Google Business Profile and search performance data live, when those services are part of your plan. | Your business listing content, review content that customers post publicly, and aggregate search performance data. | United States and globally |
2. Companies that touch our own visitors' data
These see information about people who visit impactranks.com, book a call with us, or become our client. They do not receive your customers' data. This table is here for completeness and is described in more detail in sections 4 and 5 of the Privacy Policy.
| Company | What it does | What it receives | Where |
|---|---|---|---|
| Meta (Facebook, Instagram) |
Where we advertise. Receives our advertising events so we can tell whether the ads work. | Hashed name, email and phone. Unhashed IP address and user agent. Page views and form submissions on our own site. | United States and globally |
| Calendly | Runs our booking calendar. | Name, email, phone, and the answers you give when booking a call with us. | United States |
| Stripe | Takes payment from our clients. | Billing name, email, and card details, which Stripe handles directly. We never see or store a full card number. | United States |
| Dropbox Sign | Sends and countersigns agreements. | Name, email, and the agreement itself. | United States |
| Vercel | Hosts impactranks.com. | Server logs, including IP addresses. | United States |
| Google (Analytics) |
Counts visits to our own site and shows which pages get read, where analytics is installed. | Usage data collected through cookies or similar identifiers. | United States and globally |
3. What we do not use
Naming absences is as useful as naming vendors, so: we do not use a data broker, we do not buy contact lists, we do not enrich your customers' records against third-party databases, and we do not feed your customers' information into any third-party artificial intelligence service for training. If that changes it will appear here first, with the notice period in section 4.
4. How you find out when this changes
Before we add a subprocessor to the first table, or replace one, we will update this page and email every active client at least 30 days beforehand. The version number and date at the top of this page change every time the list does.
If we have to make an emergency change, for example because a vendor fails and your service would otherwise stop, we will make it and tell you within five business days, with the reason. Your right to object under section 5 still applies.
Changes to the second table are not subject to the 30-day notice, because that table is not about your customers' data. It is still kept current here.
5. How to object
If you object to a new subprocessor on reasonable data protection grounds, email team@impactranks.com within the 30-day notice period and tell us why. We will look for a way to run your service without it. If there is no reasonable way, you may cancel the affected part of your service without penalty, and section 11 of the DPA governs the export and deletion of your data.
We are not going to make this hard. If a vendor on this list is a genuine problem for your business, we would rather hear it than lose you over it.
Athens, Georgia, United States
team@impactranks.com
Version 1.0 · Effective 4 August 2026