Subprocessors

Last updated: 24 October 2026.

This page lists the third parties that process personal data for HuntAPI. A provider's headquarters are not a promise about every processing location. The notes below say what each provider receives.

Customer API content is processed only in the EU/EEA, on Hetzner infrastructure in Germany (Falkenstein and Nuremberg) and Finland (Helsinki), and in our own datacenters in Toulouse. This applies to every customer and every plan.

Our datacenters in Toulouse are operated by WEBAPI GROUP SAS. They are a processing location, not a third-party subprocessor.

Hetzner Online GmbH

Cloud infrastructure for the service. Germany (Falkenstein and Nuremberg) and Finland (Helsinki). Processes customer API content, account data stored by the service, and security logs.

Cloudflare, Inc.

DNS, website delivery, and website security. The network is global. Processes website and DNS traffic. Cloudflare does not proxy the API and does not receive API request bodies.

Stripe, Inc. and Stripe Payments Europe, Ltd.

Payments. United States and the EEA. Processes billing details and payment-card data. Card numbers stay at Stripe. Stripe may act as an independent controller for fraud and its own legal duties. No API request bodies.

Postmark (ActiveCampaign, LLC)

Transactional email. United States. Processes recipient addresses and the content of service email. No API request bodies.

Google LLC

Website analytics. Global. Processes consented website measurement. No API request bodies.

Discord Inc.

Support notifications and internal discussion. United States. Processes messages a person sends to Discord, and limited account notices. No API request stream.

Slack Technologies, LLC

Internal communication. United States. Processes messages staff put in Slack. No API request stream.

Linear Orbit, Inc.

Issue tracking. United States. Processes issue text staff put in Linear. No API request stream.

GitHub, Inc.

Source code. United States. Processes code and engineering discussion. No customer API content.

Mistral AI

Support tickets, the documentation assistant, and a limited dashboard security profile. France. Processes ticket text, assistant messages, and a limited security profile. Mistral does not receive the API request stream.

HubSpot, Inc.

Contact forms that embed HubSpot. United States and the EEA. Processes the name, email address, and message submitted on those forms. No API request bodies.

Changes

We will give at least 30 days' notice before a new subprocessor processes customer API content, by updating this page and by email to the account address. You may object during that period, as described in the data processing agreement.

Each provider is bound by a contract that requires it to protect personal data. Where a provider processes personal data outside the EEA, the transfer terms are the 2021 Standard Contractual Clauses, described in the SCC addendum.

Email [email protected]. You can also write to the registered office. WEBAPI GROUP SAS, ZI de Vic, 10 ter route d'Escalquens, 31320 Castanet-Tolosan, France. Publication director: Josselin Liebe.