1. Scope and data-protection roles
Vashly AB uses the services below to operate and support the Service. The providers applicable to a customer depend on the features and integrations used. Service names identify the products used; contact hello@vashly.com for contractual-entity and processing details relevant to your account.
A provider may process data on Vashly’s behalf, act as a subprocessor where Vashly is Customer’s processor, or act as an independent controller for particular activities. Data suppliers and customer-selected platforms are not automatically subprocessors for every activity. Our Data Processing Addendum applies to customer-instructed processing; our Privacy Notice describes Vashly’s own processing.
2. Infrastructure and processing services
| Service | Purpose | Relevant data | Location information |
|---|---|---|---|
| Google Cloud | Production infrastructure, database hosting, stored files and database backups. | Workspace and account records, professional data, uploaded images/attachments and operational data relevant to the hosted Service. | europe-north1 for production servers, databases, stored images/attachments and database backups. |
| OpenAI API | AI-assisted content, outreach, candidate explanations and professional-evidence features, where used. | Relevant prompts, role/team information, professional-profile evidence and generated outputs. | Contact hello@vashly.com for processing-location and transfer information relevant to this service. |
| Google Gemini API | AI-assisted content generation and extraction using paid API access through Google AI Studio. | Relevant prompts, candidate and role/team information, submitted files where used, and generated outputs. | Contact hello@vashly.com for processing-location and transfer information relevant to this service. |
| TypeSafe / Jev | Candidate-role matching assistance and structured judgments. | Role conditions, projected professional-profile evidence and assessment results. | Contact hello@vashly.com for processing-location and transfer information relevant to this service. |
| Composio | Customer-authorised Gmail/Outlook connections, email sending and relevant reply/thread operations. | Connection/account identifiers, recipients, message content, thread and reply information, and relevant communication metadata. | Contact hello@vashly.com for processing-location and transfer information relevant to this service. |
| SendGrid | Transactional and service notifications, including account, team and billing communications. | Sender and recipient addresses, subjects, message content and relevant notification information. | Contact hello@vashly.com for processing-location and transfer information relevant to this service. |
3. Professional-data sources and enrichment
These services supply or enrich professional information. Their contractual roles depend on the source and lookup activity, including any data submitted by Vashly. Their inclusion here does not classify every data-supply activity as customer-instructed subprocessing.
| Service | Purpose | Relevant data | Location information |
|---|---|---|---|
| Coresignal | Professional search and profile retrieval. | Search criteria and profile identifiers submitted for lookup; professional-profile information returned by the provider. | Contact hello@vashly.com for processing-location and transfer information relevant to this service. |
| Prospeo | Contact-data enrichment. | Names and professional profile links submitted for lookup, and returned contact information. | Contact hello@vashly.com for processing-location and transfer information relevant to this service. |
| FullEnrich | Contact-data enrichment, including work-email and personal-email lookup fields. | Profile links and/or name/company information, correlation identifiers and returned enrichment results. Requests include both work-email and personal-email fields. | Contact hello@vashly.com for processing-location and transfer information relevant to this service. |
| GitHub | Public professional-account lookup and evidence of public work. | Name/account search queries and public profile, repository and activity information. The integration strips email fields from GitHub responses. | Contact hello@vashly.com for processing-location and transfer information relevant to this service. |
4. Analytics, advertising and payment services
These services support Vashly’s own operations. Applicable roles depend on the activity; payment and advertising services may also act independently under their own terms.
| Service | Purpose | Relevant data | Location information |
|---|---|---|---|
| Slack | Internal operational alerts for new signups and service-limit events. | Customer email address, signup method, company email domain, team identifiers, account/plan context and relevant limit-event information. Production use is enabled. | Contact hello@vashly.com for processing-location and transfer information relevant to this service. |
| Mixpanel | Product analytics and usage measurement. | User identifiers, relevant account properties, page/action information, event properties and autocapture data. | EU ingestion endpoint. This does not establish that every processing or support activity is limited to the EEA. |
| X / Twitter | Advertising and conversion measurement. | Browser/device and network information, page information and conversion-event data associated with the advertising pixel. | Contact hello@vashly.com for processing-location and transfer information relevant to this service. |
| Stripe | Payments, subscriptions and billing. | Customer/billing identifiers, contact information, payment and transaction information as relevant to the payment flow. | Contact hello@vashly.com for processing-location and transfer information relevant to this service. |
5. Customer-selected and optional services
Google and Microsoft provide optional identity and customer-connected Gmail/Outlook services. Relevant account identity, authorisation and mailbox data are exchanged as needed for enabled features. Composio’s integration processing is listed separately above.
Customer-enabled third-party content, such as YouTube/Vimeo embeds and externally hosted media, may transmit visitor request/device information to the relevant host. Those providers process information under their own terms and privacy notices. These optional services are not necessarily used for every customer.
6. Locations, recovery copies and transfers
Production hosting, databases, stored images/attachments and database backups are on Google Cloud in europe-north1. Database backups run twice daily and are retained for one month. The confirmed Storage bucket’s seven-day soft delete policy provides a recovery window for deleted objects.
External API processing and support access may occur elsewhere. An EU ingestion endpoint or EU infrastructure region does not establish EU-only processing across the Service. Contact hello@vashly.com for relevant location and safeguard information. Where required, transfers must have a valid transfer mechanism and necessary safeguards as described in the DPA.
7. Subprocessor changes
For material additions or replacements of subprocessors affecting Customer Personal Data under the DPA, Vashly will provide at least 30 days’ advance email notice. Customer may object on reasonable data-protection grounds. The parties will seek a resolution; if no resolution is possible, Customer may terminate the affected service under the DPA.
Keep the contact email on your customer account current. Questions and objections can be sent to hello@vashly.com.