Sub-processors
Last updated: 16 October 2026
What this page is
A sub-processor is a third party that processes personal data on our behalf. This page lists all of them. It is the authoritative list referenced by the Data Processing Agreement we sign with each customer.
The platform and the website are separated below because they are not the same risk. Customer business data is stored and processed by Amazon Web Services inside the European Union. The website processors never see it.
Sky platform and mobile app
Amazon Web Services stores and processes customer business data, inside the European Union. Expo, Apple and Google only carry push notifications and app updates: they receive a device token and the text of a notification, never the workspace data itself. Google Workspace holds our own email, including what you send to support.
| Provider | Purpose | Location |
|---|---|---|
| Amazon Web Services Amazon Web Services EMEA SARL (Luxembourg) | Hosting, databases and cache; model inference through Amazon Bedrock; voice through Amazon Nova Sonic, Amazon Transcribe and Amazon Polly; transactional email through Amazon SES | European Union (eu-west-1, Ireland; eu-north-1, Stockholm, for voice; other EU regions through Bedrock EU inference profiles) |
| Expo 650 Industries, Inc. (USA) | Delivery of push notifications and over-the-air updates to the Sky by SkyFirstLabs app | United States |
| Apple Push Notification service / Firebase Cloud Messaging Apple Inc. / Google LLC | Final delivery of push notifications to the device | United States and other |
| Google Workspace Google Ireland Ltd | Company email, including the support and privacy mailboxes | European Union / United States |
The Sky by SkyFirstLabs app contains no third-party analytics or crash reporting SDK. If we engage an error monitoring provider, it will appear here before it starts processing data.
Website, marketing and sales
These process contact and prospecting data from skyfirstlabs.com. They do not have access to any customer workspace.
| Provider | Purpose | Location |
|---|---|---|
| Vercel Vercel Inc. (USA) | Website hosting, edge delivery, product analytics | United States |
| Google Analytics 4 Google Ireland Ltd / Google LLC | Website analytics with IP anonymisation, loaded only on consent | European Union / United States |
| Resend Resend, Inc. (USA) | Transactional email delivery for contact form replies | United States |
| HubSpot HubSpot, Inc. (USA / EU) | CRM for lead and account management | European Union / United States |
| Instantly Instantly.ai | Outbound email delivery for B2B prospecting | United States |
| Calendly Calendly LLC (USA) | Meeting scheduling for discovery calls | United States |
Where a processor is established outside the European Economic Area, we rely on the EU–U.S. Data Privacy Framework where the recipient is certified, and otherwise on the European Commission's Standard Contractual Clauses. See section 07 of the Privacy Policy.
How we notify you of changes
Before a new sub-processor begins processing customer data, we update this page and notify affected customers at the contact address on their contract, in accordance with the Data Processing Agreement. Customers may object on reasonable data protection grounds.
To be told about changes, write to info@skyfirstlabs.com and we will add you to the notification list.
Change history
- 16 October 2026 — Expo (650 Industries, Inc.) added for push notifications and app updates; Apple and Google push services and Google Workspace listed. The Amazon Web Services entry now names voice (Nova Sonic in Stockholm, Transcribe, Polly) and email (SES). These processors were already in use; this page now records them.
- 2 August 2026 — First publication of this page. No sub-processor was added or removed; this records the processors already described in the Privacy Policy.