Subprocessor List

Effective Date: June 20, 2026 · Version: 1.2

This is the single published list of the third-party companies ("subprocessors") that Hubabble uses to help operate its service. It is the single canonical source of subprocessors and their live, imminent, and future status. It is referenced by the Hubabble Privacy Policy and by the Hubabble Data Processing Agreement (DPA). When those documents say "our current subprocessors," they mean this page, and any inline subprocessor table in those documents must match this list. If an inline table ever drifts from this page, this page controls.

We keep this list current so you always know who helps us run your coaching practice behind the scenes.

Who we are

This list is published by Hubabble, LLC, a member-managed multi-member limited liability company organized under Oregon law.

• Principal office and notice address: 403 Portway Avenue, Suite 300, Hood River, Oregon 97031
• Privacy and legal contact: privacy@hubabble.com
• Governing law and forum: Oregon, without regard to its conflict-of-laws rules, with venue in Hood River County, Oregon.

How to read this list

We sort our subprocessors by the role they play with the personal data involved:

• Hubabble is the controller of data about you (the coach), your account, and visitors to our sites. For that data, our subprocessors act on Hubabble's behalf.
• You (the coach) are the controller of your clients' personal data. For that data, Hubabble is your processor, and the companies below act as our subprocessors on your behalf. Your clients interact with Hubabble surfaces directly through secure tokenized links, on your behalf, to do things like book a session, complete an intake form, sign a document, or pay an invoice.
• Stripe plays a dual role. Stripe acts as a subprocessor when it processes payments on the coach's behalf, and as an independent controller for its own fraud-prevention and legal-compliance purposes. We state this dual role the same way everywhere it appears.

"Data processed" below describes categories of personal data, not every field. The exact data depends on how you use Hubabble and what your clients share with you.

Current subprocessors

These are the companies we use today or are bringing online imminently. Rows marked FUTURE / not yet active describe capabilities we are building. The data they would process is not flowing to them yet, and we will update the status before it does.

| daily.co (Pluot Labs, Inc.) | Powers your video sessions and your video room. | Session participant connection data, technical/connection metadata to deliver the video session, and audio/video media in transit during a live session | United States; global media routing | Subprocessor (our processor for your clients' session data on your behalf) | | Google LLC | Per-coach calendar and scheduling integration via the Google Calendar API (only for coaches who connect their Google Calendar) | The connecting coach's calendar event data and basic profile/email (Google scopes: calendar.events (sensitive), calendar.readonly (sensitive), userinfo.email, userinfo.profile), used only to provide your calendar and scheduling features. | United States; Google operates globally | Subprocessor | | Resend (Plus Five Five, Inc.) | Sending transactional and e-sign email (such as confirmations, receipts, document-signing requests). Our email provider can record delivery and engagement events such as opens and clicks where that is enabled. | Recipient email addresses and names, email content, and delivery and engagement events such as opens and clicks where enabled | United States | Subprocessor (our processor for client-facing email on your behalf) | | Amazon Web Services, Inc. (AWS S3) | Secure file storage for signed PDF documents and related files | Signed agreements and document files, which may include client names, signatures, and the contents of the documents | AWS region us-east-1 (US East, N. Virginia) | Subprocessor (our processor for your clients' document data on your behalf) | | Inngest, Inc. | Running background jobs and scheduled tasks (such as queued emails, cleanup, and reliability work) | Job payloads and references needed to run background work, which may include identifiers and limited personal data | United States | Subprocessor | | Cloudflare, Inc. | DNS for our domains and routing of inbound email | DNS query routing and inbound email metadata and content in transit | United States; global network | Subprocessor | | Anthropic, PBC (AI model inference, reached through the Vercel AI Gateway) | AI-assisted support behind your in-app feedback: drafting the reply you receive when we resolve a report, and reading a new report on arrival to gauge whether it has enough detail for us to act on. | The text you submit in a feedback report (its title, your description, and captured technical details such as the page you were on and recent browser console messages), which may include personal data you type in, including any client details you choose to mention | United States | Subprocessor (and, where a report mentions client details, our processor for that data on your behalf) | | Ably (Ably Real-time Ltd.) | Real-time delivery so our internal staff triage board updates live as we work through reports. | Limited to internal record identifiers and status signals (which item changed and its state). It does not carry the content of your reports or your clients' personal data, which stay on our own servers. | United Kingdom; global edge network | Subprocessor | | Stripe, Inc. (client payments), FUTURE / not yet active | Processing your clients' payments to you, so clients can pay you through Hubabble. This is imminent but not yet live. | Client payment method and card details, payment amounts, and transaction records, processed when you start accepting client payments | United States; Stripe operates globally | Dual role: Stripe acts as a subprocessor when it processes client payments on your behalf, and as an independent controller for its own fraud-prevention and legal-compliance purposes | | Recording and transcription of video sessions, FUTURE / not yet active | Optional recording of video sessions, and (separately) transcription of recordings. Neither is built or active. The transcription provider, when chosen, will not be named to you or your clients. | Audio/video recordings of sessions and text transcripts, which can include sensitive wellbeing and mental-health content | Provider and region set when selected | Subprocessor (our processor for your clients' recording/transcript data on your behalf), once active | | Zoom Video Communications, Inc., FUTURE / not yet active | For coaches who choose to run their sessions on their own Zoom, once Hubabble can create Zoom meetings on their behalf. This integration is upcoming, not yet live. | Session scheduling details and meeting metadata needed to create and manage a Zoom meeting on your behalf, processed only if you connect your own Zoom | United States; Zoom operates globally | Subprocessor (our processor for your clients' session data on your behalf), once active |

A note on sensitive data

Some of the data above can be especially sensitive: your clients' wellbeing and mental-health intake answers, your free-form client and session notes, and (in the future) session recordings and transcripts. Under laws like the GDPR, this is special-category data that needs extra care and explicit, specific consent.

What we do NOT treat as subprocessors

For clarity, some companies are sometimes assumed to be data recipients but are not, because they do not receive your personal data in a way that makes them a subprocessor:

• Font and icon assets are self-hosted by us, so they are not loaded from a third party in a way that shares your data.
• Certain internal developer and infrastructure tools we use to build and operate Hubabble do not process your personal data as subprocessors in the ordinary course.

Future subprocessors (not yet in use)

The following capabilities are on our roadmap and are not active today. We will add the relevant providers to the table above, with their purpose, data, region, and role, before any of them goes live and processes data:

• Recording of video sessions, and transcription of those recordings (the transcription provider will not be surfaced to you or your clients).
• Additional or alternative video options, such as Zoom Video Communications, Inc. for coaches who choose to run their sessions on their own Zoom, or a bring-your-own video room.
• Product analytics.

We list these here only so you can see what may be coming. None of them is receiving data now.

Changes to this list and your right to object

We may add or replace a subprocessor as we improve Hubabble. When we do:

• We will update this page. This page is always the current, authoritative list.

• You can subscribe to change notifications. Coaches can sign up to be notified in advance when we plan to add or replace a subprocessor.

• You can object. We give at least 30 days' prior notice before a new or replacement subprocessor that processes client data goes live. If you reasonably object on data-protection grounds within that period, you can tell us at privacy@hubabble.com. We will work with you in good faith to find a resolution, and if we cannot offer a commercially reasonable alternative, your remedy is to stop using the affected feature or to terminate the affected service. This matches the DPA's subprocessor-change clause (Section 8).

To subscribe to changes or to raise an objection, contact us at privacy@hubabble.com.

This Subprocessor List is part of, and incorporated into, the Hubabble Privacy Policy and Data Processing Agreement. If anything here conflicts with the DPA, the DPA controls.