Subprocessor list
Fundraise Up engages the third parties listed below to help deliver the Fundraise Up Platform (the “Service”). Where our nonprofit customers are controllers of personal data processed through the Service, these third parties act as subprocessors. This list is incorporated into our Data Processing Addendum.
Each subprocessor is engaged under a written agreement containing data protection obligations no less protective than those in our Data Processing Addendum. Where personal data is transferred out of the European Economic Area, the United Kingdom or Switzerland, the transfer is made under the EU Standard Contractual Clauses, together with the UK International Data Transfer Addendum where applicable, or under another lawful transfer mechanism such as the EU-U.S. Data Privacy Framework where the recipient is certified.
We will notify customers at least 30 days before adding or replacing a subprocessor. To receive those notifications, subscribe at privacy@fundraiseup.com. Customers may object to a new subprocessor in accordance with our Data Processing Addendum.
This list does not include software that Fundraise Up runs on its own infrastructure, or tools that receive no customer or donor personal data. Where more than one provider is listed for the same purpose, we may engage any of them for that purpose.
1. Infrastructure and platform hosting
Engaged for every customer. These providers host or transit all Customer Data processed through the Service.
| Subprocessor | Headquarters | Service provided | Personal data categories |
|---|---|---|---|
| OVH Groupe SAS (OVHcloud) | Roubaix, France | Primary infrastructure and data hosting; runs the production application and databases | All Customer Data processed through the Service |
| Amazon Web Services, Inc. | Seattle, WA, USA | Cloud infrastructure, serverless compute and secure storage | All Customer Data processed through the Service |
| Hetzner Online GmbH | Gunzenhausen, Germany | Infrastructure hosting supporting the Service | Customer Data present in hosted systems, logs, IP addresses |
| Google LLC (Google Cloud) | Mountain View, CA, USA | Cloud hosting and computing; address autocomplete and validation APIs | Donor names, postal addresses, IP addresses, request metadata |
| Cloudflare, Inc. | San Francisco, CA, USA | Content delivery, web application firewall, DDoS protection and edge storage | IP addresses, device and browser data, request metadata |
| Vercel, Inc. | San Francisco, CA, USA | Front-end deployment and hosting of donation experiences | IP addresses, cookie identifiers, form submission data, logs |
| Backblaze, Inc. | San Mateo, CA, USA | Encrypted backup and secondary storage | Any personal data present in backed-up systems |
2. Service features
Engaged where the relevant feature is in use. These providers receive donor or supporter data as part of delivering a specific capability of the Service.
| Subprocessor | Headquarters | Service provided | Personal data categories |
|---|---|---|---|
| Loqate, Inc. (GBG plc) | San Ramon, CA, USA | Postal address autocomplete and validation | Donor names, postal addresses, IP addresses |
| Lob.com, Inc. | San Francisco, CA, USA | Postal address validation | Donor names, postal addresses |
| ZeroBounce LLC | Las Vegas, NV, USA | Email address validation | Donor and supporter email addresses |
| Twilio Inc. | San Francisco, CA, USA | SMS delivery to donors and supporters | Donor phone numbers, message content, delivery metadata |
| Anthropic, PBC (Claude) | San Francisco, CA, USA | AI processing supporting Agentic Giving and platform features | Prompt and output content, which may include donor or customer personal data |
| OpenAI, LLC | San Francisco, CA, USA | AI processing supporting Agentic Giving and platform features | Prompt and output content, which may include donor or customer personal data |
| Google LLC (Gemini) | Mountain View, CA, USA | AI processing supporting Agentic Giving and platform features | Prompt and output content, which may include donor or customer personal data |
| Notion Labs, Inc. (Notion AI) | San Francisco, CA, USA | AI processing underpinning Agentic Giving; internal knowledge base | Prompt and workspace content, which may include customer personal data |
| QuarterZip | Sydney, AU | AI voice assistant used in customer onboarding | Customer personnel names and contact details, call audio and transcripts |
3. Support, communications and business systems
Engaged where a customer or a donor contacts us, and where customer correspondence, meetings and records are handled. These systems hold personal data of customer personnel, and may hold donor details where a customer or donor includes them in a message, ticket or meeting.
| Subprocessor | Headquarters | Service provided | Personal data categories |
|---|---|---|---|
| FrontApp, Inc. (Front) | San Francisco, CA, USA | Shared inbox and email management for support | Customer and donor names, email addresses, message content, attachments |
| Zendesk, Inc. | San Francisco, CA, USA | Help desk and support ticketing | Customer and donor names, emails, ticket content, attachments, IP addresses |
| Intercom, Inc. | San Francisco, CA, USA | In-product support chat | Customer names, emails, chat transcripts, usage metadata |
| OpenPhone Technologies, Inc. | San Francisco, CA, USA | Business telephony for support | Phone numbers, call logs, message content, recordings where enabled |
| Slack Technologies, LLC (Salesforce, Inc.) | San Francisco, CA, USA | Operational alerting and internal escalation of support issues | Customer or donor data only where included in an escalation |
| Google LLC (Google Workspace) | Mountain View, CA, USA | Email, calendar, documents and file storage, including AI features | Customer personnel names and email addresses, correspondence content |
| Zoom Communications, Inc. | San Jose, CA, USA | Video meetings, recordings, transcripts and AI notetaking | Participant names and emails, meeting metadata, recordings and transcripts where enabled |
4. Customer-enabled integrations
Engaged only where a Customer activates the integration in its Fundraise Up account. In each case the purpose is to transfer donation and donor records into the system the Customer has chosen, and the Customer is the controller of that destination system. No data is sent to any provider in this section unless the integration is switched on.
| Provider | Headquarters | Service provided (where enabled by the Customer) | Personal data categories |
|---|---|---|---|
| Salesforce, Inc. | San Francisco, CA, USA | To store donation and donor data in the Customer's CRM | Donor names, contact details, donation records |
| HubSpot, Inc. | Cambridge, MA, USA | To store donation and donor data in the Customer's CRM | Donor names, contact details, donation records |
| SofterWare, Inc. (DonorPerfect) | Fort Washington, PA, USA | To store donation and donor data in the Customer's CRM | Donor names, contact details, donation records |
| Bloomerang, LLC (Kindful) | Indianapolis, IN, USA | To store donation and donor data in the Customer's CRM | Donor names, contact details, donation records |
| Bonterra (EveryAction) | Washington, D.C., USA | To store donation and donor data in the Customer's CRM | Donor names, contact details, donation records |
| Virtuous Software, Inc. | Phoenix, AZ, USA | To store donation and donor data in the Customer's CRM | Donor names, contact details, donation records |
| Neon One, LLC (NeonCRM) | Chicago, IL, USA | To store donation and donor data in the Customer's CRM | Donor names, contact details, donation records |
| Microsoft Corporation (Dynamics 365) | Redmond, WA, USA | To store donation and donor data in the Customer's CRM | Donor names, contact details, donation records |
| Double the Donation, LLC (360MatchPro) | Atlanta, GA, USA | To identify employer matching-gift eligibility for a donation | Donor name, email address, employer |
5. Payment providers
These providers process donation payments. Each determines its own purposes and means for the payment data it receives and acts as an independent controller rather than as a subprocessor of Fundraise Up. Which of them are engaged depends on the payment methods the Customer enables in its Fundraise Up account. They are listed here so that customers have a complete picture of where donor data goes; their own privacy notices govern their use of it.
| Provider | Headquarters | Role | Personal data categories |
|---|---|---|---|
| Stripe, Inc. | South San Francisco, CA, USA | Card and bank donation processing | Payment credentials, donor name, email, billing address, transaction data |
| PayPal, Inc. | San Jose, CA, USA | PayPal donation processing | Payment credentials, donor name, email, transaction data |
| PayPal, Inc. (Venmo) | New York, NY, USA | Venmo donation processing | Payment credentials, donor name, transaction data |
| Apple Inc. (Apple Pay) | Cupertino, CA, USA | Wallet donation processing | Tokenized payment credentials, donor name, transaction data |
| Google LLC (Google Pay) | Mountain View, CA, USA | Wallet donation processing | Tokenized payment credentials, donor name, transaction data |
| Currence iDEAL B.V. | Amsterdam, Netherlands | iDEAL bank transfer donation processing | Bank account details, donor name, transaction data |
| Plaid Financial Ltd. / Plaid Inc. | London, UK / San Francisco, CA, USA | Bank account verification for ACH donations | Bank account details, donor name, verification data |
| Chariot Giving, Inc. (DAFpay) | New York, NY, USA | Donor-advised fund grant processing, where the Customer connects a Chariot account and enables DAFpay | Donor name, email address, postal address, donation amount, grant and transaction data |
| Gemini Trust Company, LLC | New York, NY, USA | Cryptocurrency donation processing | Wallet addresses, donor name, transaction data |
| Crypto APIs Ltd | Wilmington, DE, USA | Cryptocurrency donation infrastructure | Wallet addresses, transaction data |