Last updated 2026-04-17 · Version 1.0
Koolay Inc. uses the following subprocessors to provide the Service. Each is bound by a written agreement that includes data-protection obligations no less protective than those imposed on Koolay.
Changes to this list will be announced to admin email at least 30 days before any new subprocessor begins processing your data.
| Subprocessor | Purpose | Data processed | Location | DPA / certifications |
|---|---|---|---|---|
| Supabase Inc. | Database, auth, storage, realtime, edge functions | All Customer Data | AWS US-East-1 | DPA · SOC 2 Type II · HIPAA |
| AWS (via Supabase & Vercel) | Underlying cloud infrastructure | All data at rest | US-East-1 | SOC 1/2/3 · ISO 27001/17/18 · PCI DSS |
| Vercel Inc. | Web hosting, CDN, serverless edge | Web traffic, static assets | US multi-region | DPA · SOC 2 Type II |
| GitHub Inc. | Source code hosting (private) | Source code — no Customer Data | US | SOC 2 Type II |
| Subprocessor | Purpose | Data processed | Location | DPA / certifications |
|---|---|---|---|---|
| Stripe Inc. | Payment processing, donor receipts | Card data (tokenized), donor name, email, billing address | US | DPA · PCI DSS Level 1 · SOC 1/2 |
| Subprocessor | Purpose | Data processed | Location | DPA / certifications |
|---|---|---|---|---|
| Elastic Email Inc. | Transactional + campaign email | Recipient email, name, body | US / EU | DPA · GDPR-compliant |
| Resend (optional backup) | Transactional email | Recipient email, name, body | US | DPA · SOC 2 Type II |
| Google LLC (Gmail SMTP, tenant-configured) | Tenant-configured outbound mail | Recipient email, name, body | US / EU | SOC 2 Type II |
| Subprocessor | Purpose | Data processed | Location | DPA / certifications |
|---|---|---|---|---|
| Lob Inc. (optional) | Print & mail letters | Recipient address, letter content | US | DPA · SOC 2 Type II |
| Click2Mail.com (optional) | USPS-native print & mail | Recipient address, letter content | US | Standard ToS · USPS compliance |
| Subprocessor | Purpose | Data processed | Location | DPA / certifications |
|---|---|---|---|---|
| OpenAI, LLC | AI grant matching, embeddings, funder scoring | Grant text, tenant profile (NTEE, mission), funder summaries | US | DPA — zero-retention for API customers, no training on Customer Data |
| Anthropic PBC | AI-assisted drafting (press bulletins, outreach emails) | Tenant profile, funder/press context, draft output | US | DPA — no training on Customer Data |
Koolay currently does not use third-party product analytics or cross-site trackers.
The following are public data sources we ingest; no Customer Data is sent to them.
If you object to the addition of a new subprocessor, email [email protected] within 30 days of notice. We will work in good faith to address your concern. If we cannot resolve it, you may terminate your subscription with pro-rated refund of any unused prepaid period (otherwise our standard no-refund policy applies).
