Subprocessors
Last updated 2026-10-16. The third parties Wexlyn uses to process personal data on behalf of its customers, where they process it, and the legal mechanism for transfers out of the EU, the UK and Switzerland.
Wexlyn (CQ Marketing LLC) uses the providers below as subprocessors under the Data Processing Agreement. Each is bound by a written agreement with data-protection obligations at least as protective as ours. Platforms a customer connects themselves (Google Ads, Meta, Shopify, a CRM, a call recorder and so on) are independent controllers or the customer's own processors, not subprocessors of Wexlyn.
| Provider | Purpose | Processing location | Transfer mechanism |
|---|---|---|---|
| Vercel Inc. | Application hosting, edge network, the tracking collector | United States (functions in us-east-1); edge network worldwide | EU-US Data Privacy Framework; DPA with Standard Contractual Clauses |
| Supabase | Primary database (Postgres), authentication, file storage, backups | United States (us-east-1) | DPA with Standard Contractual Clauses (2021/914) |
| ClickHouse, Inc. | Event analytics database for tracked visits and clicks | United States (AWS us-east-1) | EU-US Data Privacy Framework; DPA with Standard Contractual Clauses |
| Cloudflare, Inc. | DNS, email routing for Wexlyn's own domain, encrypted off-site backups (R2) | United States; network worldwide | EU-US Data Privacy Framework; DPA with Standard Contractual Clauses |
| Resend, Inc. | Transactional email (sign-in, alerts, support replies) | United States | EU-US Data Privacy Framework; DPA with Standard Contractual Clauses |
| Anthropic, PBC | Wexlyn AI answers, report building and call analysis (no training on your data) | United States | EU-US Data Privacy Framework; DPA with Standard Contractual Clauses |
| Slack Technologies (Salesforce) | Relay of support chat conversations to the Wexlyn team | United States | EU-US Data Privacy Framework; DPA with Standard Contractual Clauses |
| Stripe, Inc. | Subscription billing for Wexlyn customers (card details never reach Wexlyn) | United States; EU entity for EU customers | EU-US Data Privacy Framework; DPA with Standard Contractual Clauses |
| Calendly LLC | Demo bookings on wexlyn.ai only | United States | EU-US Data Privacy Framework; DPA with Standard Contractual Clauses |
Changes
We give customers at least 30 days' notice before adding or replacing a subprocessor, by email to the workspace owner and by updating this page. A customer who objects on reasonable data-protection grounds may terminate the affected service as set out in the DPA.
Wexlyn staff
Wexlyn staff access customer data only to operate and support the service, under least-privilege permissions; staff access to a customer workspace is recorded in the audit log, which the customer can read.