Subprocessors
Waitlister — operated by Lemon Tree Ventures, LLC
Effective 1 September 2026. This page is the current list referred to in Annex III of our Data Processing Agreement, and mirrors it.
The Company authorises the engagement of the following Subprocessors to Process Company Personal Data. Each is engaged under a written agreement that imposes the data protection obligations required by Section 7.4 of the Data Processing Agreement and that provides the transfer mechanism identified against it.
"Company Personal Data" means the personal data of waitlist subscribers that we process on our customer's behalf. Our customer is the controller of that data; we are its processor.
How we give notice of changes
We give at least thirty (30) days' prior written notice before adding or replacing a Subprocessor, together with enough information for you to assess the change. Notice is given by email to the address registered on your Waitlister account, so keep that address current.
You may object to an intended change on reasonable grounds relating to data protection within 30 days of our notice. Section 7.3 of the Data Processing Agreement sets out what happens then.
Current Subprocessors
1. Google LLC — Google Cloud Platform and Firebase
| Service | Cloud hosting, Cloud Firestore, Firebase Authentication, Cloud Functions, Cloud Storage, Cloud Logging |
| Data | All categories of Company Personal Data |
| Locations | United States. Cloud Firestore in the nam5 multi-region; Cloud Functions in us-central1; Cloud Storage in the United States |
| EU transfer | Google Cloud Data Processing Addendum, incorporating the EU SCCs |
| UK transfer | UK Addendum, as incorporated by that Addendum |
| Swiss transfer | Swiss adaptations, as incorporated by that Addendum |
| Terms | https://cloud.google.com/terms/data-processing-addendum |
2. Cloudflare, Inc.
| Service | DNS, content delivery, Turnstile bot verification, edge caching, custom domain routing |
| Data | IP address, browser and device information, request metadata |
| Locations | United States, with processing at global edge locations |
| EU transfer | Cloudflare Data Processing Addendum, incorporating the EU SCCs |
| UK transfer | UK Addendum, as incorporated by that Addendum |
| Swiss transfer | Swiss adaptations, as incorporated by that Addendum |
| Terms | https://www.cloudflare.com/cloudflare-customer-dpa/ |
3. Plus Five Five, Inc., trading as Resend
| Service | Delivery of transactional and broadcast email; delivery, engagement and suppression events |
| Data | Recipient email address, name, email content composed by the Company, delivery and engagement data |
| Locations | United States |
| EU transfer | Resend Data Processing Addendum, incorporating the EU SCCs (Modules One, Two and Three) |
| UK transfer | UK Addendum, incorporated by reference under that Addendum |
| Swiss transfer | EU SCCs as modified for Switzerland under that Addendum |
| Terms | https://resend.com/legal/dpa |
4. IPinfo Inc.
| Service | Resolution of IP address to approximate geographic location at sign-up |
| Data | IP address |
| Locations | United States |
| EU transfer | IPinfo Data Processing Agreement, incorporating the EU SCCs (Modules Two and Three) |
| UK transfer | UK Addendum, as incorporated by that agreement |
| Swiss transfer | EU SCCs as modified for Switzerland under that agreement |
| Terms | https://ipinfo.io/data-processing-agreement |
5. Anthropic, PBC
| Service | Automated screening of outbound email content for fraud and abuse; generation of landing page content and marketing copy at the Company's request |
| Data | Email subject and body composed by the Company, sender name and address, reply-to address and waitlist name; and any prompts or content the Company submits to AI generation features |
| Locations | United States |
| EU transfer | Anthropic Data Processing Addendum, incorporating the EU SCCs (Modules Two and Three), governed by the law of Ireland |
| UK transfer | UK Addendum, Schedule 3 to that Addendum |
| Swiss transfer | Swiss Addendum, Schedule 3 to that Addendum |
| Terms | https://www.anthropic.com/legal/data-processing-addendum |
6. Google LLC — Gemini API, via Google Cloud
| Service | In-product support assistant |
| Data | Support messages submitted by the Company's personnel, together with account context comprising aggregate counts, waitlist configuration settings and fraud-signal identifiers. Subscriber records — including email addresses, IP addresses and device identifiers — are removed before that context is assembled. Company Personal Data reaches this Subprocessor only if the Company's personnel enter it into a support message |
| Locations | United States |
| EU transfer | As entry 1 |
| UK transfer | As entry 1 |
| Swiss transfer | As entry 1 |
| Terms | As entry 1 |
Basis of the mechanisms
The Processor relies on the standard contractual clauses identified above as the transfer mechanism for every Subprocessor. Where a Subprocessor additionally participates in the EU–US Data Privacy Framework, that participation is treated as supplementary and does not displace the clauses relied on in this Annex.
Parties that are not Subprocessors of Company Personal Data
The following receive no Company Personal Data and are therefore not Subprocessors for the purposes of the Data Processing Agreement. They are listed for transparency.
- Stripe, Inc. — payment processing and subscription billing for the Company's own account. Processes the Company's billing contact and payment data, which the Processor handles as a controller under Section 3.4 and the Privacy Policy.
- OpenAI, L.L.C. — image generation in the logo tool. Receives only the prompt the Company submits.
Customer-configured integrations
Where the Company connects a third-party service to the Services — including Zapier, the Waitlister plugin operating on the Company's own site, or an email marketing platform such as Klaviyo, Kit or SendFox — the Company does so as controller and instructs a transfer directly to that provider under its own agreement with it. Those providers are not Subprocessors of the Processor.
Questions about this list go to devin@waitlister.me.