To deliver the Squirrel365 platform we rely on a number of third-party providers. This page lists them, what each one is used for, and the categories of personal data involved. It supplements our Privacy Policy.
Providers are grouped by what they do. Each entry is labelled with the kind of relationship involved, because these are not equivalent — some providers are entrusted with data we hold on your behalf, while others simply serve a file to your browser and never store anything for us.
Our platform infrastructure and primary databases are hosted in Amazon Web Services' London
region (eu-west-2), and our identity provider uses an EU-hosted tenant. Some
providers listed below operate outside the UK and EEA; the safeguards relied on for those
transfers are set out in our Privacy Policy.
The categories of third party that receive personal data. Most are expanded into named providers in the next section; internal business systems — such as accounting, support and operational tooling — are disclosed at category level only.
| Category | What it is used for |
|---|---|
| Cloud hosting & infrastructure | Running the service; storing your projects, files and account data |
| Identity & authentication | Signing you in and managing your account credentials |
| AI service providers | Powering AI features that generate queries and content from the input you provide |
| Payments & finance | Taking subscription payments, invoicing, reconciliation and statutory accounting records |
| Product analytics & onboarding | Understanding how the product is used and providing in-app guidance |
| Marketing, marketplace & community | Product updates, the addon marketplace, and the user community |
| Support & internal tooling | Support tickets, issue tracking and operational automation |
| Content delivery & embedded media | Serving fonts, scripts, editors and video to your browser |
The providers we engage to deliver the service. Where a provider appears more than once, it is because we use two genuinely separate services from them for different purposes.
| Provider | Relationship | Purpose | Data involved |
|---|---|---|---|
| Amazon Web Services | Sub-processor | Application hosting, databases, file storage, content delivery and outbound email | All account and project data, uploaded files, email |
| Auth0 (Okta) | Sub-processor | Identity provider — authentication and user account records | Email address, name, account roles and metadata |
| Ably | Sub-processor | Real-time messaging between the platform and the desktop application | Licence key, account events |
| Provider | Relationship | Purpose | Data involved |
|---|---|---|---|
| Anthropic | Sub-processor | Generates queries and content from natural-language input in AI features | The prompt you write, and the structure of the data set it is run against |
| Google (Gemini) | Sub-processor | Alternative model for the same AI features | The prompt you write, and the structure of the data set it is run against |
| Supabase | Sub-processor | Stores AI usage records and feedback ratings | Email address of the user submitting feedback, usage counts |
| Provider | Relationship | Purpose | Data involved |
|---|---|---|---|
| Stripe | Sub-processor | Subscription billing and payment processing | Billing name and contact details, payment card data (entered directly with Stripe) |
| Provider | Relationship | Purpose | Data involved |
|---|---|---|---|
| Heap | Sub-processor | Product analytics — how features are used, to guide development | Name, email address, plan, company, industry and job role |
| Userflow | Sub-processor | In-app onboarding guides and product tours | Name, email address, plan, sign-up date |
| Provider | Relationship | Purpose | Data involved |
|---|---|---|---|
| Webflow | Sub-processor | Hosts the squirrel365.io website and the content of the addon marketplace | Website and marketplace visitor data (IP address, browser details); addon listing content and the email address of the addon's author. Developer account and licence records are held in our own database. |
| Circle.so | Sub-processor | The Squirrel365 user community platform | Account identity used to sign in to the community |
These are requested directly by your browser when a page loads. Except where noted, they receive only your IP address and browser details as a technical consequence of serving the file, and store nothing on our behalf.
| Provider | Relationship | Purpose | Data involved |
|---|---|---|---|
| Tiny (TinyMCE) | Sub-processor | Cloud-hosted rich-text editor used in the platform | Content you type into the editor, IP address and browser details |
| Google Fonts | Content delivery | Serves the typefaces used across the platform and published content | IP address, browser details |
| unpkg (npm CDN) | Content delivery | Delivers front-end interface and animation libraries to the browser | IP address, browser details |
| Vimeo | Content delivery | Hosts onboarding and help videos embedded in the platform | IP address, browser details, video playback events |
| YouTube & Loom | Content delivery | Hosts demonstration videos embedded in marketplace addon listings | IP address, browser details, video playback events |
| jQuery CDN | Content delivery | Serves a script library used by the PowerPoint viewer | IP address, browser details |
| Microsoft (Office.js) | Content delivery | Serves the library required by the PowerPoint add-in | IP address, browser details |
Squirrel365 lets you connect your own third-party accounts and add your own tracking to content you publish. Where you do, data flows to those providers because you have chosen and configured them, using your own credentials and under your own agreement with that provider. They are not our sub-processors, and we have no visibility of what they collect.
Data connectors: Google (Sheets, Drive), Microsoft (OneDrive, Excel, Entra ID), Smartsheet, HubSpot, ThoughtSpot, Power BI, Tableau, Zapier, and your own Okta tenant for authenticated viewers.
Analytics tags: If you add your own Google Tag Manager container to a published project, that tag runs in your audience's browsers under your own Google account. No tag is added unless you configure one.
Custom webhooks: If you configure a REST hook, project data is sent to the endpoint you specify.
You are the controller for these transfers and are responsible for disclosing them to your own users where required.
We review this list periodically and whenever we add, replace or remove a provider that handles personal data. The Last updated date at the top of this page reflects the most recent review.
If you have a question about a provider listed here, or need a copy of our data processing agreement, contact us at privacy@squirrel365.io.
