Subprocessors
This page lists the providers that Reach Technologies SAS ("1st Minute Lead") uses to operate the Platform, as referenced in the Legal Notice, the Privacy Policy and the Data Processing Agreement.
Clients with an active account are notified by email at least thirty (30) days before a new subprocessor handling Lead Data or Advisor data is added or replaced, in accordance with the DPA.
1. Core infrastructure
| Provider | Role | Data concerned | Location |
|---|---|---|---|
| Hostinger International Ltd (Cyprus) | Hosting of the application, the PostgreSQL database, Redis and the real-time engine | All Platform data | Data center: France (Paris) — no transfer outside the EU |
The database (PostgreSQL) and the cache/message layer (Redis) are self-hosted on this infrastructure; they are not separate providers. The relay server (TURN) used as a fallback for Web Calls is operated on the same infrastructure.
2. Ancillary services
| Provider | Role | Data concerned | Location / safeguards |
|---|---|---|---|
| Stripe Payments Europe, Ltd (Ireland) | Payment processing, subscription billing, invoices | Billing identity, email, payment method (card data is entered directly with Stripe and never touches our servers) | EU entity; possible transfers to Stripe, Inc. (USA) under the EU–US Data Privacy Framework and SCCs |
| Resend, Inc. (USA) | Sending of transactional emails (email verification, password reset, Advisor invitations, service and quota notifications) | Recipient email address, first name, content of the service email | USA — SCCs; sending domain: contact.1stminutelead.com |
| Expo (650 Industries, Inc.) (USA) | Delivery of push notifications to the "One Minute Lead" mobile application | Push token of the device, content of the notification (e.g. first name of an incoming Lead) | USA — SCCs |
| Content Square SAS (France) — added September 16, 2026 | Product analytics of the web application (app.1stminutelead.com): page analytics, session replays and frustration signals, to understand where users get stuck and improve the product | Navigation and interaction events in the application (pages viewed, clicks, scrolls, timings), technical context (browser, device, screen size), a random visitor identifier and the IP address (deleted by Contentsquare after 3 days). Form field values are never collected, and text masking is enabled so that the content of Leads displayed on screen (names, phone numbers, messages) is not recorded. Not loaded on the mobile application, the browser extension or the Script placed on Clients' websites | EU entity; visitor data hosted in the EU (Amazon Web Services, Ireland). Contentsquare's own affiliates and providers, including in the USA and the UK, operate under the EU–US Data Privacy Framework or SCCs — see Contentsquare's sub-processors list. Retention: 13 months (analytics), 1 month (session replays) |
3. Scoring module (only where enabled)
The following providers are only involved for Accounts that have the Scoring module ("Lead Optimizer") enabled — see Article 9 of the Terms of Use. Only the data necessary for the computation of the score (fields of the submitted form and browsing journal on the Client's website) is transmitted; inputs and outputs are not used to train models and are not retained by these providers beyond the processing of the request.
| Provider | Role | Data concerned | Location / safeguards |
|---|---|---|---|
| Groq, Inc. (USA) | Lead scoring — primary language-model provider | Fields of the submitted form, browsing journal of the session | USA — SCCs; no training on API data |
| Anthropic, PBC (USA) | Lead scoring — fallback provider (used only if the primary provider is unavailable) | Same as above | USA — SCCs; no training on API data |
4. Technical mentions that are not subprocessing
- Web Calls (WebRTC): the audio/video stream is exchanged directly between the visitor's and the Advisor's browsers (peer-to-peer, encrypted), or relayed through our own TURN server. If the configuration server is unreachable, the browsers may fall back to a public STUN server (Google) for connection establishment only; a STUN server sees connection metadata (IP addresses) and never the content of the call.
- Application stores (Apple App Store, Google Play): distribution channel of the mobile application; they process the Advisor's store account under their own terms, not on our behalf.
5. Contact
For any question about this page: privacy@1stminutelead.com.
This document is published by Reach Technologies SAS. For any question: contact@1stminutelead.com.
See also: Legal Notice · Privacy Policy · DPA · Terms of Use