This page lists the providers to which Berenger.dev SRL entrusts data in order to operate Swimlane. It forms part of the Data Processing Agreement and supplements the Privacy Policy.
We notify our customers by email at least 30 days before adding or replacing a sub-processor. Each customer may object under the conditions set out in Article 7 of the Data Processing Agreement.
Sub-processors
| Provider | Role | Data location | Safeguards |
|---|---|---|---|
| Hostinger International Ltd (Cyprus) | Servers for the application, the website and our support tool, database, backups | France | European Union |
| DigitalOcean, LLC (United States) | File storage: profile photos, logos, images and attachments | Netherlands (Amsterdam) | EU-U.S. Data Privacy Framework, standard contractual clauses |
| Anthropic Ireland, Ltd (Ireland) | Artificial intelligence: contact analysis, fit with the ideal customer profile, reply and message suggestions, campaign messages | United States | Standard contractual clauses; requests deleted within 30 days; no training on our data |
| TypeSafe AI, Inc. (United States) | Artificial intelligence: reading what replies received on LinkedIn mean (interested, contact later, question…) and how well contacts fit the ideal customer profile | United States | Standard contractual clauses (module 2, Irish law); no training on our data |
| TeraShift GmbH (Evomi, Switzerland) | Residential proxies through which connections to LinkedIn pass, in the chosen country and region | Switzerland and the chosen country | Adequacy decision (Switzerland); traffic remains end-to-end encrypted with LinkedIn |
| Plus Five Five, Inc. (Resend, United States) | Sending of service emails | United States | EU-U.S. Data Privacy Framework, standard contractual clauses; logs retained for 30 days |
| PostHog, Inc. (United States) | Usage statistics and error reports; with your consent, audience measurement and masked session recordings | Germany (European hosting), possible access from the United States | EU-U.S. Data Privacy Framework, standard contractual clauses; events retained for 1 year (7 years on a paid plan), session recordings for 30 days |
| Cloudflare, Inc. (United States) | Content delivery network and protection of the application against attacks; where applicable, running the Jev artificial-intelligence model (Workers AI) | Global network | EU-U.S. Data Privacy Framework, standard contractual clauses |
| Stripe Payments Europe, Ltd (Ireland) | Payment, subscriptions, VAT calculation, invoices | European Union and United States | EU-U.S. Data Privacy Framework, standard contractual clauses; Stripe is also a controller for its own obligations (fraud, legal obligations) |
Other technical services
These services receive limited data when certain features are used.
| Service | Use | Data received | Location and safeguards |
|---|---|---|---|
| OpenStreetMap Foundation (Nominatim, United Kingdom) | Converting contacts’ locations into coordinates for the map | Location text (city, region, country), without name, sent from our servers | United Kingdom and Netherlands; adequacy decision (United Kingdom) |
| CartoDB Inc. (CARTO, United States) | Base maps of the contacts map | Browser IP address (truncated by CARTO, retained for 30 days) when the map is displayed | United States; EU-U.S. Data Privacy Framework |
| Kikliko, Inc. (Klipy, United States) | GIF search in messaging | Search terms, sent from our servers; browser IP address when previews are displayed | United States |
| IP address geolocation services (ipapi.co; as a fallback ip-api.com, api.ipify.org, ipapi.com, freeipapi.com) | Inferring the country and region used to connect to LinkedIn | Browser IP address, when logging in to the application | Outside the European Union for some of them |
Swimlane’s internal services (application, email sending, LinkedIn connection, Heedback support tool, internal dashboards) are operated by Berenger.dev SRL on our Hostinger servers in France.
LinkedIn is not our sub-processor: it is the platform with which you ask us to interact on your behalf, under its own terms.
Infrastructure location and access by authorities
In accordance with Article 28 of Regulation (EU) 2023/2854 (Data Act):
- Jurisdiction of the infrastructure: our application servers and our database are located in France, with a provider established in the European Union; our files are stored in the Netherlands with a provider subject to United States law. Providers established in the United States may be subject to access requests from the authorities of that country.
- Our measures: hosting of the database in the European Union; encryption of communications; encryption at rest of LinkedIn sessions and email addresses; contractual commitments from our providers to challenge unlawful or disproportionate access requests and to respond to them only to the extent required. We act on a request from a third-country authority concerning our customers’ data only if it is based on an applicable international agreement or if the law requires us to do so, and we inform the customer concerned where this is permitted.