Sub-Processors
snizzly engages the following third parties to deliver the service. We disclose them in full so a buyer can complete their procurement or DPIA review without a separate questionnaire. For an institutional procurement, a DPA template is available on request from privacy@snizzly.com.
Last reviewed · 2026-05-24
1 · Core service sub-processors
| Sub-processor | Purpose | Data | Location | Basis | Status |
|---|---|---|---|---|---|
| Anthropic (via gateway.ops360.io) | Humanizer + detector inference; all LLM calls routed through our own gateway on the ops360.io VPS. | Document text (encrypted in transit; not retained by Anthropic per API terms when used via our gateway with caching disabled). | US (Anthropic infrastructure) | Standard contractual clauses (Anthropic's DPA) | LIVE |
| Hostinger (KVM VPS, IP 168.231.122.116) | Production hosting for snizzly.com, Postgres database, application server. | All user account data, encrypted document blobs, AnalyticsEvent rows, ApiKey records. | Lithuania (EU) — datacenter location confirmed at procurement | Hostinger DPA + GDPR-aligned | LIVE |
| Let's Encrypt / ISRG | TLS certificate issuance for snizzly.com. | Domain control verification only (no user data). | US | Public CA; no PII processed | LIVE |
| Ziina (B2C AED checkout) | Process B2C card payments in AED. | Cardholder data handled by Ziina under PCI-DSS scope; we receive transaction ID, amount, status — never the PAN. | UAE | UAE PDPL governed | LIVE |
| PayPal (USD fallback B2C) Currency fallback only. | Process B2C card payments where AED is unavailable. | Cardholder data handled by PayPal under PCI-DSS scope; we receive transaction ID, amount, status. | US | Standard contractual clauses (PayPal DPA) | LIVE |
2 · Operational sub-processors
These power Heba’s autonomous-operator stack (outreach, search, workflow automation, control-plane services). They handle prospect data and operational telemetry rather than end-user account or document data.
| Sub-processor | Purpose | Data | Location | Basis | Status |
|---|---|---|---|---|---|
| Mailcow on mail.opshosts.com (self-hosted) | Outbound + inbound mail for heba@, sales@, mohammad@, malsayed@ on snizzly.com. | Prospect emails (cold outreach + replies); thread content. | Same Hostinger KVM as service (Lithuania, EU) | Self-hosted; we control encryption at rest and retention | LIVE |
| Hunter.io | Email verification + discovery for B2B outreach. | Prospect work emails + domains. | US | Hunter DPA; legitimate-interest basis for B2B outreach | LIVE |
| Serper.dev | Google search API for sector discovery + competitor monitoring. | Search queries (not user PII). | US | No personal data processed | LIVE |
| n8n on n8n.ops360.io (self-hosted) | Workflow automation; currently reply-handling classification. | Email body content during classification (in-memory, not persisted). | Same Hostinger KVM as service (Lithuania, EU) | Self-hosted; we control retention | LIVE |
| OPS360 control plane (opshosts.com, IP 147.93.107.90) | DNS (BIND), reverse proxy (Caddy), Git (Gitea), backup (restic REST), observability (Prometheus + Loki + Grafana), uptime monitoring (Uptime Kuma). | DNS queries, encrypted backups of user data, logs subject to retention policy. | Lithuania (EU) | Self-hosted on Hostinger KVM under our control | LIVE |
3 · Deferred or not in scope
| Sub-processor | Purpose | Data | Location | Basis | Status |
|---|---|---|---|---|---|
| Google Analytics 4 Deferred 2026-05-24. The GA4 tag in site code remains until the consent banner ships; will be removed if not adopted post-banner. | Third-party analytics. | Page-view events + device metadata. | US | — | DEFERRED |
| Apollo.io Free tier blocks API; awaiting reply-rate data before procurement decision. | B2B prospect data. | — | US | — | NOT ADOPTED |
| DocuSign Awaiting first qualified B2B lead before procurement. | Contract signature workflow. | — | US | — | NOT ADOPTED |
| PostHog (self-host) Will move to §Operational once deployed on opshosts. | Product analytics. | — | Same Hostinger KVM (planned) | — | PLANNED |
| Sentry Loki structured logs cover error tracking inside our locked stack. | Error tracking. | — | — | — | REJECTED |
4 · Sub-processor change policy
Any addition, removal or material change above triggers a Vendor Review by the Trust head, an update to this page within seven days of go-live, an email to customers on annual contracts within thirty days via privacy@snizzly.com, and a fresh DPA on file where applicable before any data flows.
5 · Data subject rights
To exercise rights under the UAE PDPL (Federal Decree-Law 45/2021), the KSA PDPL, Lebanon Law 81/2018, Egypt Law 151/2020, or — where applicable — the GDPR, write to privacy@snizzly.com. We respond within thirty days per UAE PDPL Art. 13(4).