## Compliance #### Complete legal, privacy, and compliance policies ## Subprocessors **Effective Date:** June 18, 2025 **Last Updated:** June 18, 2025 ## Introduction This document lists all subprocessors that PopHop Technologies, Inc. ("PopHop") uses to process personal data on behalf of our customers. This list is maintained in accordance with our Data Processing Agreement and applicable data protection laws including GDPR, CCPA, and other privacy regulations. **What is a Subprocessor?** A subprocessor is a third-party service provider that PopHop engages to process personal data on behalf of our customers. All subprocessors are contractually obligated to maintain appropriate security measures and data protection standards. **Contact Information:** PopHop Technologies, Inc. 2648 International Boulevard Ste 115 #1108 Oakland, CA 94601, US Email: legal@pophopmail.us ## Current Subprocessors ### Core Infrastructure and Hosting #### Vercel Inc. - **Location:** San Francisco, California, United States - **Service Purpose:** Web hosting, content delivery, and platform infrastructure - **Data Processing:** Website hosting, static content delivery, platform performance optimization - **Privacy Contact:** privacy@vercel.com - **Website:** https://vercel.com - **Data Location:** United States - **Certifications:** SOC 2 Type II compliant #### Supabase, Inc. - **Location:** San Francisco, California, United States - **Service Purpose:** Database hosting and real-time platform services - **Data Processing:** User data storage, real-time messaging, authentication services - **Privacy Contact:** privacy@supabase.com - **Website:** https://supabase.com - **Data Location:** United States - **Certifications:** SOC 2 Type II compliant #### Cloudflare, Inc. - **Address:** 101 Townsend Street, San Francisco, CA 94107, United States - **Service Purpose:** Content delivery network (CDN) and security services - **Data Processing:** Website performance optimization, security threat protection, traffic routing - **Privacy Contact:** privacyquestions@cloudflare.com - **Website:** https://www.cloudflare.com - **Data Location:** Global (with data residency controls) - **Certifications:** ISO 27001, SOC 2 Type II ### Payment Processing #### Stripe, Inc. - **Address:** 510 Townsend Street, San Francisco, CA 94103, United States - **Service Purpose:** Payment processing, billing, and financial transaction management - **Data Processing:** Payment card information, billing addresses, transaction records, payout processing - **Privacy Contact:** dpo@stripe.com - **Website:** https://stripe.com - **Data Location:** United States (with global processing capabilities) - **Certifications:** PCI DSS Level 1, SOC 1 Type II, SOC 2 Type II, ISO 27001 ### Communication and Support #### Intercom, Inc. - **Address:** 55 2nd Street, San Francisco, CA 94105, United States - **Service Purpose:** Customer support, chat services, and user communication - **Data Processing:** Support conversations, user interaction data, help desk functionality - **Privacy Contact:** privacy@intercom.com - **Website:** https://www.intercom.com - **Data Location:** United States and Ireland - **Certifications:** SOC 2 Type II, ISO 27001 #### Loops - **Service Purpose:** Marketing email campaigns and newsletter automation - **Data Processing:** Email addresses, marketing preferences, campaign engagement data - **Privacy Contact:** privacy@loops.so - **Website:** https://loops.so - **Data Location:** United States - **Certifications:** GDPR compliant #### Resend - **Service Purpose:** Transactional email delivery and notification services - **Data Processing:** Email addresses, transactional email content, delivery analytics - **Privacy Contact:** privacy@resend.com - **Website:** https://resend.com - **Data Location:** United States - **Certifications:** GDPR compliant ### Analytics and Performance #### Google LLC - **Address:** 1600 Amphitheatre Pkwy, Mountain View, CA 94043, United States - **Service Purpose:** Website analytics and performance monitoring - **Data Processing:** Website usage data, user interaction analytics, performance metrics - **Privacy Contact:** privacy@google.com - **Website:** https://www.google.com - **Data Location:** United States (with global processing) - **Certifications:** ISO 27001, SOC 2 Type II - **Services Used:** Google Analytics ## Planned Future Subprocessors The following subprocessors are planned for integration into PopHop's platform. Customers will receive 30 days' advance notice before these subprocessors are implemented, as required by our Data Processing Agreement. ### Workflow Automation (Version 2) #### Zapier, Inc. - **Address:** 548 Market Street, Suite 62411, San Francisco, CA 94104, United States - **Service Purpose:** Workflow automation and third-party app integrations - **Data Processing:** User workflow data, integration configurations, automated task execution - **Privacy Contact:** privacy@zapier.com - **Website:** https://zapier.com - **Planned Implementation:** Q3 2025 #### Make (Integromat) - **Service Purpose:** Advanced automation platform and integration services - **Data Processing:** Workflow automation data, integration scenarios, data transformation - **Privacy Contact:** privacy@make.com - **Website:** https://www.make.com - **Planned Implementation:** Q3 2025 #### n8n - **Service Purpose:** Open-source workflow automation platform - **Data Processing:** Workflow configurations, automation data, custom integrations - **Website:** https://n8n.io - **Planned Implementation:** Q4 2025 ## Subprocessor Selection Criteria PopHop carefully evaluates all subprocessors based on the following criteria: ### Security Standards - Industry-standard security certifications (SOC 2, ISO 27001, etc.) - Comprehensive data protection and privacy policies - Regular security audits and vulnerability assessments - Appropriate technical and organizational measures ### Legal Compliance - Compliance with applicable data protection laws (GDPR, CCPA, etc.) - Standard Contractual Clauses for international data transfers - Transparent privacy practices and data handling procedures - Appropriate data processing agreements ### Business Requirements - Reliable service delivery and uptime guarantees - Scalable infrastructure to support platform growth - Integration capabilities with PopHop's technical architecture - Responsive customer support and incident management ### Data Protection Measures - Data encryption in transit and at rest - Access controls and authentication mechanisms - Data retention and deletion procedures - Incident response and breach notification processes ## Data Processing Activities ### Categories of Data Processed Subprocessors may process the following categories of personal data: **Identity Data:** - Names, email addresses, usernames - Profile information and preferences - Account authentication credentials **Community Data:** - Community participation and engagement records - Content created and shared within communities - Communication and messaging data **Transaction Data:** - Purchase and sale records - Payment and billing information - Digital product delivery data **Technical Data:** - IP addresses and device information - Website usage and interaction data - Performance and analytics information ### Processing Purposes Subprocessors process personal data for the following purposes: **Service Delivery:** - Platform hosting and infrastructure services - Payment processing and financial transactions - Communication and customer support **Performance and Analytics:** - Website performance monitoring and optimization - User experience analysis and improvement - Security monitoring and threat detection **Marketing and Communication:** - Email marketing and newsletter delivery - Transactional notifications and alerts - Customer support and help desk services ## Geographic Data Processing ### Primary Data Locations - **United States:** Primary data processing location for most subprocessors - **European Union:** Limited processing through Cloudflare and Intercom EU facilities - **Global CDN:** Content delivery through Cloudflare's global network ### International Transfer Safeguards All international data transfers are protected by appropriate safeguards: **Legal Mechanisms:** - Standard Contractual Clauses (SCCs) for EU/UK transfers - UK International Data Transfer Agreement (IDTA) for UK transfers - Swiss Data Protection Law compliance for Swiss transfers **Technical Measures:** - End-to-end encryption for data in transit - Data encryption at rest in all storage locations - Access controls and authentication for all data access ## Changes to Subprocessors ### Notification Process PopHop will provide customers with advance notice of subprocessor changes: **New Subprocessors:** - 30 days' advance notice before engaging new subprocessors - Details about the new subprocessor's services and data processing - Customer right to object to new subprocessors **Subprocessor Changes:** - Notice of material changes to existing subprocessor arrangements - Updates to data processing activities or locations - Changes to security measures or certifications ### Customer Rights Customers have the following rights regarding subprocessor changes: **Objection Rights:** - Right to object to new subprocessors within 30 days of notice - Right to terminate affected services if objections cannot be resolved - Alternative solutions where technically feasible **Information Rights:** - Access to current subprocessor information and contracts - Details about data processing activities and security measures - Regular updates about subprocessor compliance and certifications ## Subprocessor Oversight ### Due Diligence PopHop maintains ongoing oversight of all subprocessors: **Initial Assessment:** - Security and compliance evaluation before engagement - Review of data protection policies and procedures - Assessment of technical and organizational measures **Ongoing Monitoring:** - Regular review of subprocessor security certifications - Monitoring of security incidents and breach notifications - Annual assessment of compliance and performance ### Contractual Requirements All subprocessors are bound by comprehensive data processing agreements: **Data Protection Obligations:** - Processing only on PopHop's documented instructions - Maintaining confidentiality of all personal data - Implementing appropriate security measures **Security Requirements:** - Industry-standard encryption and access controls - Regular security assessments and vulnerability testing - Incident response and breach notification procedures **Audit Rights:** - PopHop's right to audit subprocessor compliance - Access to security documentation and certifications - Cooperation with customer audit requests ## Contact and Support ### Questions About Subprocessors For questions about our subprocessors or data processing activities: **Email:** legal@pophopmail.us **Subject:** Subprocessor Inquiry **Response Time:** Within 2 business days ### Reporting Concerns To report concerns about subprocessor data handling: **Email:** legal@pophopmail.us **Subject:** Data Processing Concern **Include:** Specific details about the concern and affected subprocessor ### Customer Requests For customer requests related to subprocessor data processing: **Email:** legal@pophopmail.us **Subject:** Customer Data Request **Include:** Customer information and specific request details ## Updates and Maintenance ### List Maintenance This subprocessors list is maintained and updated to reflect: - Addition of new subprocessors with advance notice - Changes to existing subprocessor information - Updates to data processing activities and locations - Changes to security certifications and compliance status ### Version Control - **Current Version:** 1.0 (June 18, 2025) - **Update Frequency:** As needed with minimum 30 days' notice for material changes - **Customer Notification:** Email alerts for significant updates - **Archive:** Previous versions maintained for compliance purposes **Last Updated:** June 18, 2025 _This subprocessors list is maintained in accordance with PopHop's Data Processing Agreement and applicable data protection laws. We are committed to transparency about our data processing practices and the third parties we work with to provide our services._