Trust
Subprocessors
These are the vendors that can process customer data on our behalf — your account, your Microsoft tenant content, and anything the product handles for you. The list is complete as of the review date: if a vendor is not on it, your customer data does not reach it.
Separately, and named here for completeness: our site loads Google AdSense and the TikTok advertising pixel, on signed-in pages as well as public ones. They receive ordinary web analytics — which pages are visited, and device and browser information — plus, on the pricing and sign-up pages, an event recording that a plan was viewed or an account created. Our servers additionally report checkout and purchase events to TikTok, carrying the amount and your contact details hashed with SHA-256; the privacy policy sets that out in full. They do not receive your Microsoft 365 mail, files, or calendar, which is why they are not subprocessors of customer data and are not listed below.
Until August 23, 2026 the TikTok pixel was also sent the email address, phone number and account id of every signed-in visitor, in plain text and without asking. That was wrong, it was never disclosed here, and it has been removed. If we ever reinstate that kind of matching it will be hashed, behind a real consent choice, and written on this page before it ships.
Last reviewed September 9, 2026
| Subprocessor | Purpose | Data categories | Processing region | More |
|---|---|---|---|---|
| Microsoft | Your Microsoft 365 tenant is the system of record for managed customers: Outlook, OneDrive, SharePoint, and Teams. Our automations reach it through Microsoft Graph, and the automation logic itself runs on Azure Functions and Logic Apps. |
| Your tenant's own Microsoft region, chosen by you at sign-up; our Azure automation resources run in the United States. | microsoft.com |
| Google Cloud / Firebase | Provides authentication and the application database used for customer accounts, product records, and saved projects. |
| United States | cloud.google.com |
| Vercel | Hosts and serves the impressionsdirect360.com web application and its API routes. Vercel AI Gateway also authenticates and routes Qwen website-design requests to an approved model provider. |
| United States (primary application deployment region), with a global edge network and AI provider routing. | vercel.com |
| Stripe | Processes all card payments and subscription billing. Card details are entered directly into Stripe and are never sent to, or stored on, our servers. |
| United States | stripe.com |
| Tucows / OpenSRS | Provides the registry connection behind domain registrations and the infrastructure behind custom-domain mailboxes purchased through our storefront. |
| OpenSRS-operated infrastructure; processing location depends on the service and provider network. | opensrs.com |
| Resend | Delivers transactional email — sign-in and verification messages, receipts, support replies, and automation notifications. |
| United States | resend.com |
| Google (Gemini API) | Runs model calls for the storefront assistant, logo prompts, and content tools. It does not design or refine websites. |
| United States | ai.google.dev |
| Alibaba Cloud / Fireworks AI (Qwen) | Serves Qwen 3.8 Max only for website generation and website refinement through Vercel AI Gateway. Each request requires zero-data-retention-capable routing. |
| Provider processing network. Saved customer accounts and website projects remain in our United States Firebase database; model processing is transient and is not represented as US-only. | vercel.com |
| Self-hosted inference provider (not currently in use) | A separate inference path exists in the codebase for open-weight managed-workplace experiments. It is not the Qwen website designer and does not serve a shipping customer feature today. |
| United States | Details |
About the AI inference row
Qwen website-design requests are routed through Vercel AI Gateway using the provider and zero-data-retention requirements disclosed in the table above. The separate inference path used for internal experiments resolves its endpoint from configuration at runtime and checks it against the following host allowlist. That experimental path does not serve the Qwen website designer or another shipping customer feature today:
- Azure AI Foundry
*.services.ai.azure.com - DeepInfra
api.deepinfra.com - Together AI
api.together.xyz - Fireworks AI
api.fireworks.ai
No customer content is currently sent through this experimental path. If that changes, the active provider and processing location will be disclosed here before the feature ships.
When this list changes
Adding a subprocessor means changing this page and the review date on it. If you are a managed customer and want to be told directly before a new subprocessor starts handling your data, ask us at legal@impressionsdirect360.com and we will add you to the notice list. We would rather keep a short list of people to email than promise a mechanism we have not built.
Listing a vendor here is not a statement about their certifications or ours. We hold no security certification of our own — see what we do and do not claim.