Legal
Sub-processors
Every third party that may process prospect personal data on our behalf, what it receives, and where it operates.
Last updated 3 August 2026 · xcelit, Time Residency, Sector 63, Gurugram, Haryana 122098, India
1. Current sub-processors
This list is maintained under clause 6 of the Data Processing Agreement. Each provider is engaged under data-protection terms no less protective than ours, and xcelit remains liable for their performance.
| Provider | Purpose | Data received | Region |
|---|---|---|---|
| Vercel | Application hosting and edge delivery | All data in transit; application logs | United States |
| Neon | Primary database | Prospect contact details, campaign content, engagement records | United States |
| Resend | Email delivery and engagement webhooks | Recipient address, message content, delivery and engagement events | United States |
| Upstash | Rate limiting, send pacing and operational counters | Hashed keys and counters; no message content | United States / global edge |
| Inngest | Background job orchestration | Job payloads containing record identifiers; no message bodies | United States |
| Anthropic | Message drafting and reply classification | Prospect first name, job title, company name and public activity signals; inbound reply text | United States |
| Hunter.io | Email address discovery and mailbox verification | Prospect name and company domain; candidate email addresses | European Union (France) |
| Apollo.io | Audience targeting and contact enrichment | Search criteria; returned prospect business contact details | United States |
2. A note on message generation
Drafting an email that references something real about a prospect means sending that context to a language model. What we send is limited to the fields listed above — first name, title, company, and public activity signals — never a full contact record or your list. Inbound replies are also classified this way, which necessarily means the reply text is processed.
This data is not used to train models. If that constraint matters to you contractually, say so before you start sending and we will confirm the current terms in writing.
3. Changes to this list
We give at least 30 days’ notice before adding or replacing a sub-processor. To receive those notices, email support@xcelit.co.in asking to be added to the list. If you reasonably object on data-protection grounds within the notice period, you may terminate the affected service and receive a pro-rata refund of prepaid fees.