Sub-processors
Last updated: 8 October 2026
This page lists the third parties that process personal data on FlyB’s behalf in delivering the Services, and — separately — the services that you may connect yourself, which FlyB does not control.
It is referenced by the Privacy Policy and by the Data Processing Addendum, and is the authoritative list for both.
1. FlyB’s sub-processors
Each of these processes personal data on FlyB’s instructions, under a written contract that binds it to confidentiality and to using the data only for the purpose we specify.
| Provider | What it does for FlyB | Data involved | Location | Terms |
|---|---|---|---|---|
| Amazon Web Services, Inc. | Hosting, database, file storage, backups and e-mail infrastructure. Everything FlyB stores lives here | All data stored by the Platform | United States | Privacy · GDPR |
| Stripe, Inc. | Payment processing for FlyB subscriptions, and the checkout your own customers use | Billing identity, transaction records. Card data is held by Stripe, never by FlyB | United States | Privacy · DPA |
| Google LLC — Google Cloud and Google APIs | Google Sign-In, Google Calendar synchronisation, Google Places (Active Search), the Indexing API | Account identity for sign-in; calendar busy ranges and event data for connected calendars; search queries for Active Search | United States | Privacy · Cloud |
| Google LLC — Google Analytics | Aggregate product analytics on FlyB’s own sites | IP-derived approximate location, device and page-view data of visitors to FlyB’s own sites | United States | Data privacy |
| Unsplash Inc. | Suggested cover images for AI-written blog posts | The search term derived from the post. No personal data | United States / Canada | Privacy |
| TypeSafe AI, Inc. | Runs FlyB Hunt AI and the AI conditions of CRM automations: its Jev model scores each contact against the Hunt Rule a customer writes, or judges whether a contact’s new messages, or the contact’s record, match a condition a customer writes, and returns the score or the probability | For Hunt AI: the Hunt Rule, with the organization’s name, sector, website and custom-field names; and for each contact analysed, the parts that bear on the rule of the messages, internal notes, tasks, appointments, e-mail activity, CRM history, purchases, custom fields and profile attributes (origin, campaign, company, city and state, e-mail domain, phone country code, tags, Lead Score) of the period searched. For an AI condition about a message: the condition, the organization’s name and sector, the contact’s new messages and up to 20 messages of that conversation. For an AI condition about a contact: the condition, the organization’s name and sector, and the same parts of the contact’s record from the last 90 days, messages of the period included. In both, names, e-mail addresses, phone numbers and street addresses are removed, including from inside the text — of the e-mail and the phone, only the domain and the country code are sent. Not used to train TypeSafe’s models | United States | Privacy · DPA |
| Telegram Messenger Inc. | Internal notifications to FlyB’s own team, delivered to FlyB staff’s Telegram accounts. Nothing is sent to or from your customers | The name, e-mail address and phone number of a new account’s owner, with the organization’s name, sector, country and sign-up source; the name and description of newly created pages and calendars; and the text and sender e-mail address of messages written to FlyB through FlyB Chat. Messages written to your own organization are never included | United Arab Emirates | Privacy · Bot terms |
1.1 Data obtained from Google APIs
Data obtained from Google APIs is subject to stricter handling than anything else in the Platform, and is never shared with any of the providers above other than Amazon Web Services, which hosts it. It is never sent to any AI model. See Privacy Policy, section 6.
1.2 Fonts on published pages
Both landing page layout styles are set in a typeface served by Google Fonts
(fonts.googleapis.com and fonts.gstatic.com). A visitor’s browser requests those
font files directly, which means their IP address and browser user agent reach Google
LLC on the first load of a published page, blog or short link. Nothing else is sent:
no account data, no contact data, no form input, and Google Fonts sets no cookies.
| Provider | What it does | What reaches it | Location | Terms |
|---|---|---|---|---|
| Google LLC — Google Fonts | Serves the web fonts the page layouts are set in | Visitor IP address and user agent, on font requests only | United States | Privacy · Google Fonts FAQ |
2. Services you connect yourself
These are not FlyB sub-processors. When you enable one, you instruct FlyB to exchange data with it, and the provider then handles that data under its own terms, as an independent controller or as your processor — not FlyB’s.
FlyB does not determine how these providers use the data, and is not responsible for their practices. Reviewing their terms is your responsibility.
| Service | What it does | What reaches it | Terms |
|---|---|---|---|
| Your SMTP provider (Gmail, Google Workspace, Amazon SES, or any other you configure) | Delivers every e-mail FlyB sends for you | The full content of your e-mails and the recipients’ addresses | Your provider’s |
| Your Stripe account | Takes payments from your own customers | Your customers’ billing and payment data | Stripe |
| Your Google account (Calendar) | Two-way sync of bookings | Booking details and guest name and e-mail | |
| Meta Platforms — WhatsApp Business Platform | Carries the conversations of the WhatsApp numbers you connect, in both directions | Phone numbers, WhatsApp profile names and the content of the messages exchanged. If you choose to import them, the contacts saved in your WhatsApp Business app. FlyB never requests your past conversations | WhatsApp Business |
| WhatsApp (Meta Platforms) — WhatsApp Web | Carries the conversations of the numbers you link through WhatsApp Web, as a linked device of the phone, in both directions | Phone numbers, WhatsApp profile names, the content of the messages exchanged and their delivery and read receipts; where you switch it on, the online status of the contacts a number follows. FlyB never requests your past conversations | WhatsApp Terms of Service |
| Make.com (Celonis) | Runs your own automation scenarios | Whatever your scenarios pass | Make |
| OpenRouter, Inc. | The AI video and image generators | See below | OpenRouter Privacy |
| Your own Google Analytics / Tag Manager | Measures your published pages, blogs and short links inside your own Google account | Visitor data from your own sites |
2.1 OpenRouter — a special case
The AI video and AI image generators run on your own OpenRouter account, with an API key stored in your browser only.
Requests, prompts, reference images and results travel directly between your browser and OpenRouter. They never pass through FlyB’s servers. FlyB neither transmits nor stores them.
OpenRouter is a router: it forwards your request to the model provider you chose, which is a further independent party with its own retention and training practices. Those practices vary considerably between models, and OpenRouter offers its own account-level controls over them.
Because FlyB neither instructs nor controls this processing, OpenRouter is not a FlyB sub-processor. Your relationship is directly with OpenRouter, governed by OpenRouter’s Privacy Policy and its terms. Read them, and the policy of the model you select, before submitting anything confidential, personal or regulated.
3. How we manage sub-processors
Before engaging a sub-processor we assess its security posture, its data-protection commitments and its transfer mechanisms. Each is engaged under a written contract imposing data-protection obligations no less protective than those FlyB owes to you, and we remain liable to you for its performance.
4. Notice of changes
We will update this page before a new sub-processor begins processing personal data, or as soon as reasonably practicable where an urgent change is necessary to maintain the Services.
Customers with a Data Processing Addendum in place may subscribe to notifications of changes by writing to [email protected] with the subject line “Sub-processor notifications”, and may object to a new sub-processor on reasonable data-protection grounds as set out in section 6 of that Addendum.
5. International transfers
All the sub-processors above, except Telegram, operate in the United States or transfer data there; Telegram operates from the United Arab Emirates. Transfers out of the EEA, the United Kingdom and Switzerland rely on the Standard Contractual Clauses and the applicable addenda; transfers out of Brazil rely on the mechanisms permitted by Articles 33 to 36 of the LGPD. See Privacy Policy, section 8.
6. Contact
Questions about this list: [email protected].