Last updated: April 2026. This list supplements the Data Processing Addendum.
| Vendor | Purpose | Data | Location |
|---|---|---|---|
| Vercel | Application hosting and edge delivery | IP, request metadata, all data in transit | United States (global edge) |
| Supabase | PostgreSQL database, authentication, storage | Lead form submissions, account data, content | United States |
| Twilio | SMS/MMS messaging delivery | Phone number, message content, delivery metadata | United States |
| Bird (CRM) | Lead automation and conversational messaging | Name, email, phone, message content, lifecycle metadata | European Union / United States |
| Resend | Transactional and notification email | Email address, message content, delivery metadata | United States |
| Google Analytics 4 | Anonymized usage analytics | IP (anonymized), page views, scroll depth, CTA clicks | United States |
| OpenAI / Anthropic (as applicable) | Internal LLM tooling for content drafting and admin workflows | Only data explicitly submitted by an admin operator; not customer Personal Data by default | United States |
Notice of changes
We notify customers of new or replacement subprocessors at least 30 days before they begin processing customer data. Customers may object on reasonable data-protection grounds; if we cannot accommodate, the customer may terminate the affected service.
Subscribe to updates
Email privacy@goodlookingco.com with subject “Subprocessor updates” to be added to the change-notification list.