Effective: 23 September 2026
Verification notice for this draft: The service names below come from the founder's inventory. They are not evidence of signed provider agreements, approved account settings or every service's actual deployment. Except where stated, contracting legal entities, processing countries, retention and onward providers remain unverified. Complete those fields and remove unused services before publishing this as the final register. Do not copy another company's supplier entities or assume that a supplier's headquarters are its processing location.
1. How to read this list
Customer processing / DPA: A supplier appointed by willdo that processes Customer Personal Information on our behalf for the Service is a subprocessor under our DPA.
Our business / Privacy Policy: A provider receiving account, billing, website, marketing or other information for purposes we determine is covered by our Privacy Policy. Depending on the activity and its agreement, it may be our service provider or a recipient acting independently. It is not automatically a subprocessor of customer work.
Both: The same provider can support our business and process customer work, for example where a support message contains a customer's work content. Its role depends on the actual activity. Listing a capability does not mean every customer's information is sent to that provider.
Customer-appointed services: Models, apps, remote MCP servers, databases and other endpoints selected and contracted directly by a customer are not automatically willdo-appointed subprocessors. Their actual account, endpoint and use determine the recipient. See section 7.
2. Hosting, network and delivery
Service | Purpose and information | Scope and location status |
Amazon Web Services (AWS) | Primary servers and hosting infrastructure; customer content, database and operational information as hosted. Confirm the precise storage and backup services. | Both. Primary server country: United States, confirmed by founder. Exact AWS region, billing entity, backup locations and onward services: verify. |
Cloudflare | DNS, traffic delivery and network security; IP addresses, request/security metadata and any request content processed by the configured proxy or service. | Both where customer traffic is processed. Contracting entity, products enabled and processing countries: verify. Do not infer that Workers AI is enabled. |
Mailgun | Transactional and support email delivery; email addresses, message content, delivery metadata and attachments where included. | Both where customer content is sent. Contracting entity, account region and retention: verify. |
3. willdo-appointed AI and inference services
These entries concern willdo's own accounts used for authorised operational processing, support or investigations. The same brand connected under a customer's own account has a different contractual role. Operational models may receive relevant prompts, work context, tool proposals, documents or diagnostic evidence. Model names and versions can change without creating a new processing company; a new receiving company must be assessed and disclosed under the DPA.
Service | Proposed function and information | Verification required |
Anthropic — Claude Team and API | Operational assistance, approved support and investigations; relevant work or diagnostic content. Scope: Both. | Identify which product actually receives content, contracting entity, processing countries, no-training terms, retention and access settings. |
OpenAI — ChatGPT Business and API | Operational assistance, approved support and investigations; relevant work or diagnostic content. Scope: Both. | Confirm product, entity, locations and applicable data controls separately for Business and API accounts. Do not treat them as identical services. |
Google Gemini | Operational assistance, approved support and investigations; relevant work or diagnostic content. Scope: Both. | Identify the actual enterprise/API product, entity and terms. An unspecified Gemini or consumer account is not an approved customer-content processing arrangement. |
SpaceXAI / xAI — Grok | Potential approved investigation or operational inference, as identified in the founder's answers; relevant diagnostic or work context. Scope: Both if used. | Confirm actual account/provider identity, deployed use, DPA, no-training conditions and countries. “SpaceX” alone is not a sufficient contracting-entity record. |
Fireworks AI | Potential approved investigation or operational inference; relevant diagnostic or work context. Scope: Both if used. | Confirm actual deployment, contracting entity, countries, retention and no-training arrangements. |
Self-hosted models: The willdo-hosted trial and Auto models, including the founder-identified Gemma model, are operated as part of willdo. Downloading and self-hosting model weights does not, by itself, make the model author a recipient of customer prompts. The infrastructure operator must still be listed. Verify where embeddings, speech synthesis and other internal model services actually run; add any separate hosting or inference company before it receives customer content. Also check identity/sign-in, model-download, push-notification and monitoring services for additional recipients.
Only approved business/API arrangements consistent with the DPA may receive customer content. This draft does not authorise indiscriminate copying of customer work into staff AI tools.
4. Communication, support and internal operations
Service | Purpose and information | Scope and verification |
Google Workspace — Gmail, Drive, Meet, Calendar, Docs and Sheets | Business communications, operational files and support records, including customer content when necessary for support. | Both. Verify contracting entity, storage/access locations, sharing settings and retention. Meeting recording is not automatically authorised. |
Slack | Internal coordination and necessary support or incident information. | Both if customer content is included. Verify entity, countries, retention and approved channels. |
Zoom | Meetings, participant details and communications; recordings or transcripts only where separately enabled and appropriately notified. | Our business; Both if customer work is actually shared. Verify configuration, entity, countries and retention. |
SAAS First | Support cases, reports, screenshots and AI-assisted triage. | Its public policy identifies Southern Vector Limited as operator. If the same company operates the willdo support deployment, this is an internal system, not a separate subprocessor. Confirm that fact and list its actual infrastructure/AI suppliers wherever they are additional recipients. |
Customer support content can create a separate copy from the original work item. Apply the retention and access rules to those copies, not only to the original conversation.
5. Payments, accounting and administration
Service | Purpose and information | Scope and verification |
Stripe | Payments when paid plans are introduced; customer/contact details, payment references, transaction and billing information. | Our business. Future billing use; not evidence that the free beta is charging customers. Confirm activation, entity, countries and role under the relevant payment services. |
Xero | Accounting and invoices; business/customer details and transaction records. | Our business. Verify entity, countries, actual data fields and retention. Not permission to send work content into accounting. |
Corporate Services New Zealand Limited | Accounting, audit or financial administration; corporate, billing, transaction and tax information as required. | Our business; professional recipient role depends on engagement. Name supplied by founder; verify legal identity, engagement, access locations and retention. |
6. Website, consent, sales and advertising
These services are not authorised by this register to receive customer prompts, work documents, connected-app records or outputs for advertising or sales targeting. Consent and tracking settings must match the published Privacy Policy. The live website and authenticated application require separate checks.
Service | Purpose and information | Scope and verification |
Google Analytics (GA4) | Website or limited product-usage measurement; permitted event, device, referral and page metadata, not work content. | Our business. Verify tags, transmitted fields, entity, countries, retention and consent configuration. |
CookieYes | Cookie notices and preferences; consent choices and relevant technical identifiers. | Our business. Verify live deployment, entity, processing countries and consent-record retention. |
Apollo.io | willdo's own business prospecting and sales research; professional contact and company details. | Our business; not customer-work processing merely because willdo also offers an Apollo connection. Verify source rights, notifications, account terms and locations. |
LinkedIn Sales Navigator | willdo's own prospecting and business-relationship research; professional profiles and correspondence. | Our business. Verify contracting entity and relevant data handling. |
Reddit Ads / Reddit Pixel | Website campaign measurement and advertising; permitted website, device and conversion information. | Our business. Confirm whether pixel is active, relevant choices, recipient entity and locations. |
LinkedIn Ads / Insight Tag | Website campaign measurement and advertising; permitted website, device and conversion information. | Our business. Confirm deployment, choices, entity and locations. |
Google Ads | Advertising and conversion measurement; permitted website, device and campaign information. | Our business. Confirm deployment, choices, entity and locations. |
The provider's own terms may give it independent purposes for some information. Assess those purposes rather than describing every advertising or payment recipient as acting solely on willdo's instructions.
7. Customer-selected models, integrations and other recipients
Customers can connect models, apps, databases and other services using their own authorised accounts. Depending on the work, information may go to that model or app, an email recipient, a shared document, a public website, or another destination the customer authorises. Those destinations cannot be exhaustively listed as willdo's own suppliers.
Customers must review the provider identity, endpoint, permissions and applicable terms for their connections. willdo's own obligations for handling and transmitting information remain in place. Read-only source access can still disclose information to a model or another destination. Stopping a task or disconnecting a service does not necessarily remove the recipient's existing copy.
We maintain this register as our processing arrangements change. Appointments and objections concerning willdo subprocessors follow the DPA, including advance notice of materially relevant new or replacement subprocessors. Changes to our own-business providers are reflected in this list and the Privacy Policy as appropriate.
Questions and subprocessor objections: [email protected]. Include your business, the affected provider, the relevant processing and the specific concern. Do not send credentials or unnecessary sensitive information.
