Effective date: September 17, 2026
J&T Solutions Inc., doing business as GTM ("GTM"), uses third-party service providers to deliver the GTM platform. When one of them processes personal data on behalf of our customers, it is a subprocessor. This page lists them and explains how we manage changes. It forms Annex III of our Data Processing Addendum.
1. What a subprocessor is
Our customers control the personal data they put into GTM, and GTM processes that data for them. A subprocessor is a company GTM engages that may process that data. GTM puts written data protection terms in place with each subprocessor and remains responsible for them as the Data Processing Addendum describes.
This page does not list services you choose to connect, such as your CRM, calendar, mailbox provider or LinkedIn account, which process data under your own agreement with them. It also does not list the licensed business-data providers from which GTM obtains prospect data for its own purposes, which our Privacy Policy describes.
2. Subprocessors
| Provider | Service | Processing purpose | Data categories | Processing location |
|---|---|---|---|---|
| Vercel | Cloud hosting and AI gateway | Runs the web application and APIs; routes AI requests from the website assistant | All data in the Services, in transit and during processing | Available on request |
| Supabase | Database, storage and authentication | Stores workspace data and signs users in | Account data, contacts, messages, campaigns, activity records | United States (AWS us-east-2) |
| Fly.io | Cloud hosting | Runs background services | Data needed by those services, such as lead search and domain provisioning | United States |
| Upstash | Rate limiting | Protects the Services from abuse | Hashed request keys | Available on request |
| Resend | Service email | Sends GTM's own service email, such as notifications, invitations, status updates and support replies. Does not carry customer outreach | Recipient addresses and the content of those service emails, delivery events | Available on request |
| Unipile | Account connectivity | Connects customers' own LinkedIn accounts and mailboxes | Account connection details, profiles, messages and invitations | Available on request |
| OpenRouter, and the model providers it routes to | AI model routing and inference | Qualification, research, writing, reply classification and assistants | Contact names, professional profiles and research, company information, and message content needed for the feature | Available on request |
| Firecrawl | Website reading | Reads public web pages for company research and onboarding | Requested web addresses and page content | Available on request |
| Apify | Public profile retrieval | Reads the public professional profile of a contact a customer already holds, to research and write messages to them | Public profile URLs and public profile information | Available on request |
| ZeroBounce | Email verification | Checks whether an email address can receive mail | Email addresses | Available on request |
| Clay | Contact enrichment | Finds business contact details for a named person, where used | Names, companies, profile URLs and business contact details | Available on request |
| Stripe | Payments | Processes subscription and credit payments | Billing contact details and payment method details | Available on request |
| Twilio | SMS | Sends and receives text messages for customers who enable SMS | Phone numbers, message content, registration details | Available on request |
| Namecheap | Domain registration | Registers sending domains bought through GTM | Domain names and registrant contact details | Available on request |
| Cloudflare | DNS | Configures DNS for sending domains bought through GTM | Domain names and DNS records | Available on request |
Some subprocessors are used only when a customer enables the related feature. For locations marked "Available on request", email support@trygtm.com. Transfers of personal data from the EEA, UK and Switzerland are protected as Section 11 of the Data Processing Addendum describes.
3. How data is handled
- Passwords. A password entered to connect a LinkedIn account is passed to the connection provider in a single request, and GTM does not store, log or return it.
- AI requests. Model requests can contain personal data and message content, and we do not describe them as anonymous. In-product requests are routed through a provider configured to exclude model providers that use request data for training.
- Diagnostics. Operational error and performance reporting uses event codes and identifiers rather than message bodies, prompts, credentials or full web addresses.
- Payment cards. Our payment provider handles card details. We store customer and subscription identifiers, invoices and billing status, not full card numbers.
4. Updates and notifications
We update this page at least 30 days before a new subprocessor starts processing customer personal data. In an emergency we may replace a subprocessor sooner, and we will give notice as soon as practicable. We update the page when a subprocessor is removed, without advance notice. To receive email notice of changes, email support@trygtm.com with the subject line "Subprocessor updates". Customers with a Master Services Agreement are also notified at their designated contact.
5. Objections
If you have reasonable data protection grounds to object to a new subprocessor, email support@trygtm.com within 15 days of the notice and explain your grounds. We will work with you in good faith to address the objection. If we cannot resolve it, you may terminate the affected part of the Services as Section 6.4 of the Data Processing Addendum describes.
Contact. J&T Solutions Inc., d/b/a GTM, 251 Little Falls Drive, Wilmington, DE 19808, United States. Email support@trygtm.com.