Subprocessor List
1. What this document is
Our Privacy Policy (Sections 8 and 13) and our Terms and Conditions (Section 13) refer to a Subprocessor List. This is that document.
A subprocessor is a company we engage to help operate 123Exec and which may process information on our behalf, under contract, only to provide its service to us. This page is the current list and is maintained as providers change. Where the Privacy Policy names providers inline, it does so as of that Policy’s own effective date; where the two differ, this list is the current one.
2. Current subprocessors
Supabase — database, authentication, and the sign-in emails that carry an invitation or a password reset. Processes account details, Customer Data, and the email address of anyone invited to an account. Hosted on Amazon Web Services in us-east-1, Northern Virginia, United States.
Netlify — application hosting and the scheduled functions that run our daily and weekly checks. Processes whatever is contained in a request to the Service. us-east-2, Ohio, United States.
Stripe — payment processing and subscription billing. Processes billing contact details and payment information. We never see or store full card numbers. United States.
Anthropic — the artificial-intelligence features. Processes only the information a given feature needs to answer, scoped to the relevant company’s own data. Under Anthropic’s Commercial Terms of Service, it may not train models on content submitted through its services. United States.
Resend — delivery of operational alert emails to the Company. Processes the recipient address and the contents of those alerts, which can include the name and email address of a coach whose account is flagged as inactive. It does not send mail to customers or their users. United States.
Rewardful — referral attribution, so that a coach who introduced a company is credited. Processes a first-party referral cookie and the resulting attribution record. Canada.
PostHog — company-level product analytics. Runs only for a visitor who has accepted analytics in our consent banner; until then the library is not loaded and no request is made. Events are attributed to the customer organization rather than to a named individual, no individual person profiles are created, and no sessions are recorded. United States.
3. Notes on particular providers
PostHog was switched on during 27 August 2026, and this list was updated the same day, which is what Section 6 commits us to.
It had been off since 21 August, when we found that the analytics key then in use belonged to a project nobody at the Company could open: password resets on both of our addresses returned no such account. Rather than leave a third party collecting data we could not audit or delete from, we turned it off. The project now in use was created by us on 27 August, on PostHog’s United States infrastructure, and we control it.
Three limits apply and are enforced in our own code rather than left to a provider setting: analytics load only after a visitor accepts them; events are attached to the customer organization and never to a person, so no individual person profiles exist; and session recording is disabled. Session recording is additionally switched off in the PostHog project itself, so contradicting our Privacy Policy would take two deliberate changes rather than one accidental one.
Resend is not in the Privacy Policy’s inline list. Privacy Policy Section 8 names six providers as at its effective date and does not name Resend, because the alerting it delivers goes to us rather than to customers. It is included here because those alerts can contain a coach’s name and email address, which is personal data, and a subprocessor list that omits a provider on the grounds that the recipient is us would not be worth much. This is why Section 8 defers to this list.
Rewardful is Canadian. It is based in Alberta, is fully remote, and runs on Heroku and Amazon Web Services. Its personnel access its systems from Canada. This is the reason Privacy Policy Section 13 does not claim that every provider processes information solely within the United States.
4. What we do not do
We do not use session replay or session recording. We do not record, reconstruct, or play back how anyone moves through the interface. It was removed from the product entirely.
We do not use cookies for advertising, and we do not permit any provider to use cookies on the Service for cross-context behavioral advertising.
We do not sell personal information.
We do not permit Customer Data to be used to train a generalized artificial-intelligence model.
5. Where information is handled
We are based in the United States and the Service is operated from the United States. Most of the providers above store and process information there, in the regions named.
We do not represent that every provider processes information exclusively within the United States. Rewardful is a Canadian company. Other providers are organized outside the United States, or have personnel outside it who may access information while operating, supporting, or securing their service. Where we engage such a provider we do so under contract terms requiring it to protect that information consistently with our Privacy Policy and applicable law.
6. How you learn about changes
Terms and Conditions Section 13 commits us to providing a way to learn of material new subprocessors. This page is that way.
Every change to this list is recorded in Section 7 with the date it took effect, so the list can be compared against any earlier version. Where an addition is material — a new provider that will process Customer Data or personal information — we will post it here and notify the account owner.
7. Change history
27 August 2026, version 1.1. PostHog switched on, on a project the Company controls, and its entry updated from “not currently enabled” to a description of what it now collects. No provider added or removed.
27 August 2026, version 1.0. First publication. Records the six providers named in Privacy Policy Section 8, and adds Resend, which that Section does not name. Notes that PostHog is listed but not currently enabled.
8. How to contact us
Questions about this list, or about any provider on it, can be sent to EPIQ Development, Inc., Attn: Privacy Contact, info@123exec.com.