Sub-processors
Last updated: July 2026
POWR uses the following third-party sub-processors to deliver its services. Each sub-processor is engaged under a written agreement with data protection obligations substantially equivalent to those in POWR's Data Processing Agreement.
POWR will provide at least 30 days' prior notice of any addition or replacement of a sub-processor by updating this page and notifying customers via email. To object to a new sub-processor, contact [email protected].
Core Infrastructure
| Sub-processor | Purpose | Location | Data Processed | Transfer Mechanism |
|---|
| Google LLC (Google Cloud Platform) | Infrastructure, compute, storage, databases | USA | All personal data collected through POWR apps | EU-US DPF + SCCs |
| Cloudflare, Inc. | DNS, CDN, WAF, DDoS mitigation, edge compute | USA / Global edge | Network traffic, static assets (transient cache only) | EU-US DPF + SCCs |
Payments
| Sub-processor | Purpose | Location | Data Processed | Transfer Mechanism |
|---|
| Stripe, Inc. | Payment processing | USA | Payment transaction data, email addresses | EU-US DPF + SCCs |
| PayPal Holdings, Inc. | Payment processing | USA | Payment transaction data, email addresses | SCCs |
| Braintree (PayPal subsidiary) | Payment processing | USA | Payment transaction data, email addresses | SCCs |
Communications
| Sub-processor | Purpose | Location | Data Processed | Transfer Mechanism |
|---|
| SparkPost (Bird) | Transactional email delivery | USA | Email addresses, names, email content | SCCs |
Analytics
| Sub-processor | Purpose | Location | Data Processed | Transfer Mechanism |
|---|
| Google LLC (Google Analytics) | Product usage analytics and visitor behavior tracking | USA | Usage data, IP addresses, cookie data, device identifiers | EU-US DPF + SCCs |
Support
| Sub-processor | Purpose | Location | Data Processed | Transfer Mechanism |
|---|
| Zendesk, Inc. | Customer support and ticketing | USA | Support ticket data, email addresses, names | SCCs |
Merchant-Activated Integrations
The following sub-processors are only engaged when a merchant explicitly enables the relevant integration. They do not process data for all POWR customers.
| Sub-processor | Purpose | Location | Data Processed | Transfer Mechanism |
|---|
| Google LLC (Google Sheets) | Merchant-configured data sync | USA | Form submission data | EU-US DPF + SCCs |
| Klaviyo, Inc. | Merchant email marketing sync | USA | Contact data, form submissions | SCCs |
| Mailchimp (Intuit) | Merchant email marketing sync | USA | Contact data, form submissions | SCCs |
Transfer Mechanisms
| Abbreviation | Meaning |
|---|
| EU-US DPF | EU-US Data Privacy Framework — vendor is certified under the European Commission's adequacy decision of July 2023 |
| SCCs | Standard Contractual Clauses — European Commission's Standard Contractual Clauses (Decision 2021/914, Module Two: Controller to Processor) |
Questions
For questions about POWR's sub-processors or to exercise your right to object to a new sub-processor, contact [email protected].
For POWR's full Data Processing Agreement, visit https://www.powr.io/dpa.