Data recipients

Subprocessors and other recipients

Effective 2026-09-08 · Version 1.2.0

How to read this schedule

Role follows the data flow—not the vendor name.

Subprocessors process Customer Personal Data for PortalSix. Customer-directed platforms receive data only when a customer connects or instructs Slash Social to use them. Other recipients may act as independent controllers for their own regulated or direct activities.

DPA status: PortalSix-approved for release. This schedule is incorporated into the published DPA and identifies the current recipient set by version and SHA-256.

30 days’ notice

The DPA provides advance notice before a new subprocessor begins processing Customer Personal Data, except for documented emergency replacements.

Reasonable objections

Customers may object during the notice period on reasonable data-protection grounds through the support form.

No residency promise

Locations and transfer safeguards describe current processing; they do not create a regional data-residency commitment.

Hash-addressed

Every change creates a new manifest version and content hash so notice and acceptance evidence can identify the exact schedule.

Related information:

Data Processing Addendum →Privacy Policy →Trust Center →Object or ask a question →

Processor chain

Active subprocessors

These providers process Customer Personal Data on PortalSix’s behalf for the stated service purposes.

Cloudflare, Inc.Cloudflare provides hosting, native Workers AI inference, AI Gateway transport and Unified Billing, storage, delivery, queueing, and security infrastructure. On approved OpenAI routes, Gateway forwards inference inputs to OpenAI and returns its outputs; Cloudflare is not the sole inference processor on those routes.
Data: Customer content; media; workspace and user identifiers; configuration; audit and operational records; AI prompts, selected media, transcripts, embeddings, and generated outputs required for requested AI featuresLocations: Global infrastructure; no regional data-residency commitmentCloudflare Customer DPA v6.4, EU SCCs, UK Addendum, Swiss adaptations, and applicable Data Privacy Framework coverage
OpenAI OpCo, LLCOpenAI is the inference processor and data recipient for fixed structured-output routes through Cloudflare AI Gateway, receiving relevant prompts and selected context and returning outputs. The approved schedule covers these fixed routes; customer-data egress also requires separate persisted recipient approval and deployment reconciliation. Unified Billing is not Cloudflare-only processing.
Data: Customer prompts and selected context; generated outputs; technical request metadataLocations: United States and other provider processing locations; no regional data-residency commitmentOpenAI Services Agreement and incorporated DPA, including applicable EEA/Swiss and UK transfer mechanisms, under the reviewed business-use interpretation for Cloudflare Unified Billing; managed-account applicability remains a documented interpretation, not vendor-confirmed coverage
HubSpot, Inc.HubSpot receives information submitted through Slash Social website and support forms and may mirror customer communications.
Data: Contact details; form contents; page and browser context; support and compliance communicationsLocations: United States and other locations described by HubSpotHubSpot DPA dated 2026-04-14, EU SCCs, UK Addendum, Swiss provisions, and applicable Data Privacy Framework coverage

Customer choice

Customer-directed platforms

These platforms are not presented as PortalSix subprocessors merely because a customer directs a connection, publication, retrieval, analytics, or CRM workflow.

Slack Technologies, LLC
Slack is the customer-selected workspace platform through which the customer directs Slash Social workflows.
HubSpot, Inc.
HubSpot CRM is connected only when a customer administrator authorizes Slash Social to act on the customer's HubSpot account.
Salesforce, Inc.
Salesforce is connected only when a customer administrator authorizes Slash Social to act on the customer's Salesforce account.
Meta Platforms, Inc.
Facebook, Instagram, and Threads receives data only when a customer connects that platform and directs the relevant publishing, retrieval, analytics, or design workflow.
TikTok Inc.
TikTok receives data only when a customer connects that platform and directs the relevant publishing, retrieval, analytics, or design workflow.
X Corp.
X receives data only when a customer connects that platform and directs the relevant publishing, retrieval, analytics, or design workflow.
Google LLC
YouTube receives data only when a customer connects that platform and directs the relevant publishing, retrieval, analytics, or design workflow.
LinkedIn Corporation
LinkedIn receives data only when a customer connects that platform and directs the relevant publishing, retrieval, analytics, or design workflow.
Pinterest, Inc.
Pinterest receives data only when a customer connects that platform and directs the relevant publishing, retrieval, analytics, or design workflow.
Bluesky Social, PBC
Bluesky receives data only when a customer connects that platform and directs the relevant publishing, retrieval, analytics, or design workflow.
Canva Pty Ltd
Canva receives data only when a customer connects that platform and directs the relevant publishing, retrieval, analytics, or design workflow.
Adobe Inc.
Adobe Express receives a request only when a customer supplies an Adobe Express design link for metadata retrieval.
Google LLC
Google Analytics receives bio-page visitor data only when a customer configures its own GA4 measurement ID for that page.

Separate roles

Other active recipients

These services may act as independent controllers for the activities described below.

Stripe, LLC
Stripe provides billing and payment services and acts as an independent controller for payment, fraud-prevention, regulatory, and related activities identified in its terms.
Google LLC
Google serves website fonts and receives ordinary browser request metadata when those fonts load.