1.Services Phlare uses
| Sub-processor | What it does for Phlare | Where | Personal data it handles | Transfer safeguards |
|---|---|---|---|---|
| Contabo GmbH | Hosting: the servers that run Phlare and hold its database and uploaded files | Germany (EU) | All customer data held in Phlare | Data stays in the EU, under the GDPR (the UK treats the EU as adequate) |
| Twilio Inc. (SendGrid) | Email delivery for workspaces that send with Phlare, and Phlare's own account emails | United States | Recipient email addresses and the content of those emails; delivery events | The EU Standard Contractual Clauses and the UK Addendum to them, in SendGrid's data protection addendum |
This list last changed on 16 October 2026.
Before a new sub-processor starts handling customers’ personal information, we update this list and email the owners of every workspace at least 14 days in advance, as clause 6 of the Data Processing Agreement provides.
2.Services you connect yourself
Phlare works with services a business connects with its own credentials. When you connect one, Phlare sends it, and receives from it, what you have set up — and nothing else. Your use of it is governed by your own agreement with that provider, which decides where it processes data and how; it is your supplier, not our sub-processor, and is used only if you connect it.
| Service | What Phlare does with it, when you connect it |
|---|---|
| Your own mail server or email provider | Sending your email from your own domain (SMTP), when you choose it instead of Phlare sending. |
| Your inbound mail service | Forwarding replies into Phlare — for example SendGrid Inbound Parse, Mailgun, Postmark, Amazon SES or Cloudflare Email Workers. |
| Google (Gmail, Google Workspace) and Microsoft (Outlook, Microsoft 365) | Sending and reading a colleague’s own mailbox, and their calendar, once they connect it. |
| Your SMS gateway — BulkSMS, Clickatell or Twilio | Sending text messages and receiving replies and delivery reports, on your account and at your provider’s rates. |
| Twilio Voice | Calls made and received in the browser, and call recordings, if you connect a phone line. |
| Meta — WhatsApp Business Platform, Messenger and Instagram | Messages, templates and calls on your WhatsApp Business account and your pages. |
| Your shop — Shopify or WooCommerce | Orders, customers, products and website activity sent into Phlare, and coupons sent back. |
3.Services that receive no personal information
- Pwned Passwords (Have I Been Pwned): when somebody chooses a new Phlare password, the first five characters of a one-way hash of it are sent to check it against known breaches. The password, its full hash and the email address are never sent.
- The fonts and images on our pages are served from our own servers.