Data recipients

Subprocessors and other recipients

Effective 2026-08-11 · Version 1.0.0

How to read this schedule

Role follows the data flow—not the vendor name.

Subprocessors process Customer Personal Data for PortalSix. Customer-directed platforms receive data only when a customer connects or instructs Slash Social to use them. Other recipients may act as independent controllers for their own regulated or direct activities.

DPA status: PortalSix-approved for release. This schedule is incorporated into the published DPA and identifies the current recipient set by version and SHA-256.

30 days’ notice

The DPA provides advance notice before a new subprocessor begins processing Customer Personal Data, except for documented emergency replacements.

Reasonable objections

Customers may object during the notice period on reasonable data-protection grounds through the support form.

No residency promise

Locations and transfer safeguards describe current processing; they do not create a regional data-residency commitment.

Hash-addressed

Every change creates a new manifest version and content hash so notice and acceptance evidence can identify the exact schedule.

Related information:

Data Processing Addendum →Privacy Policy →Trust Center →Object or ask a question →

Processor chain

Active subprocessors

These providers process Customer Personal Data on PortalSix’s behalf for the stated service purposes.

Cloudflare, Inc.Cloudflare provides the hosting, storage, delivery, queueing, and security infrastructure used to operate Slash Social.
Data: Customer content; media; workspace and user identifiers; configuration; audit and operational recordsLocations: Global infrastructure; no regional data-residency commitmentCloudflare Customer DPA v6.4, EU SCCs, UK Addendum, Swiss adaptations, and applicable Data Privacy Framework coverage
HubSpot, Inc.HubSpot receives information submitted through Slash Social website and support forms and may mirror customer communications.
Data: Contact details; form contents; page and browser context; support and compliance communicationsLocations: United States and other locations described by HubSpotHubSpot DPA dated 2026-04-14, EU SCCs, UK Addendum, Swiss provisions, and applicable Data Privacy Framework coverage
OpenAI OpCo, LLCOpenAI processes only the prompts, content, and media needed for AI-assisted features a customer invokes.
Data: Customer prompts and selected content; generated output; media or audio when requested; technical request metadataLocations: United States and other locations described by OpenAIOpenAI DPA effective 2026-01-01, EU SCCs, UK Addendum, and applicable Data Privacy Framework coverage

Customer choice

Customer-directed platforms

These platforms are not presented as PortalSix subprocessors merely because a customer directs a connection, publication, retrieval, analytics, or CRM workflow.

Slack Technologies, LLC
Slack is the customer-selected workspace platform through which the customer directs Slash Social workflows.
HubSpot, Inc.
HubSpot CRM is connected only when a customer administrator authorizes Slash Social to act on the customer's HubSpot account.
Salesforce, Inc.
Salesforce is connected only when a customer administrator authorizes Slash Social to act on the customer's Salesforce account.
Meta Platforms, Inc.
Facebook, Instagram, and Threads receives data only when a customer connects that platform and directs the relevant publishing, retrieval, analytics, or design workflow.
TikTok Inc.
TikTok receives data only when a customer connects that platform and directs the relevant publishing, retrieval, analytics, or design workflow.
X Corp.
X receives data only when a customer connects that platform and directs the relevant publishing, retrieval, analytics, or design workflow.
Google LLC
YouTube receives data only when a customer connects that platform and directs the relevant publishing, retrieval, analytics, or design workflow.
LinkedIn Corporation
LinkedIn receives data only when a customer connects that platform and directs the relevant publishing, retrieval, analytics, or design workflow.
Pinterest, Inc.
Pinterest receives data only when a customer connects that platform and directs the relevant publishing, retrieval, analytics, or design workflow.
Bluesky Social, PBC
Bluesky receives data only when a customer connects that platform and directs the relevant publishing, retrieval, analytics, or design workflow.
Canva Pty Ltd
Canva receives data only when a customer connects that platform and directs the relevant publishing, retrieval, analytics, or design workflow.
Adobe Inc.
Adobe Express receives a request only when a customer supplies an Adobe Express design link for metadata retrieval.
Google LLC
Google Analytics receives bio-page visitor data only when a customer configures its own GA4 measurement ID for that page.

Separate roles

Other active recipients

These services may act as independent controllers for the activities described below.

Stripe, LLC
Stripe provides billing and payment services and acts as an independent controller for payment, fraud-prevention, regulatory, and related activities identified in its terms.
Google LLC
Google serves website fonts and receives ordinary browser request metadata when those fonts load.