Subprocessor List

Growth Station — Subprocessor List

Last updated: October 1, 2026

Document owner: Petro Liporace Cardoso de Souza

Translation notice: This English version is provided for convenience. If it conflicts with the original Portuguese document, the Portuguese version prevails.

This document forms part of the Data Processing Agreement (DPA) and Privacy Policy. It is publicly available for review by Controllers (customer Projects).

This list covers the Growth Station / GS Engage platform and its features, including Prospct.AI. All customers are subject to international data transfers in the operation of the platform; the providers involved in each data flow depend on the features and integrations used.

The countries and regions below describe the intended processing environments and do not guarantee exclusive data residency. The scope of each DPA depends on the applicable service and agreement. Security certifications and the existence of a DPA do not, by themselves, demonstrate adoption of ANPD standard contractual clauses; see section 1.12.

Companies covered

This document applies to both legal entities below, referred to as "Growth Machine", within their activities related to the platform:

• Growth Machine Editora e Aceleração Ltda. — Brazilian company registry (CNPJ) 26.324.112/0001-91.
• Growth Machine Serviços e Editora Ltda. — Brazilian company registry (CNPJ) 41.485.584/0001-10.

In customer relationships, the service provider is the legal entity identified in the agreement, accepted commercial proposal, or service order. Each company must comply with this document's obligations in the activities it performs, according to its role in processing the data and applicable law.

---

1. Current Subprocessors

1.1 Infrastructure and Storage

1.2 Communications — Email and Calendar

1.3 Communications — WhatsApp

1.4 Communications — VoIP

1.5 Artificial Intelligence

Langfuse — self-hosted on AWS in Ohio, United States (us-east-2): Growth operates its own instance to record prompts, responses, and metadata from AI interactions. AWS is the subprocessor hosting these records; this processing and the corresponding international transfers fall within the AWS scope described in section 1.1.

1.6 Analytics and Monitoring

1.7 Support

1.8 Google — Workspace and Authentication

The Cloud Data Processing Addendum (CDPA) applies to services covered by the corresponding agreement. A Google account, OAuth access, or a personal Gmail account does not establish coverage under the Google Workspace or Google Cloud CDPA.

1.9 Microsoft

1.10 Cache and Connection State

1.11 Notifications

Redis/ElastiCache and SNS are AWS services, not additional subprocessors.

1.12 International Transfers — ANPD Standard Contractual Clauses

Document review: October 1, 2026. The table indicates whether the public documents reviewed include the standard contractual clauses issued by ANPD (Resolution CD/ANPD No. 19/2024), also known as Brazil SCCs.

“Included” means the public document expressly provides for these clauses, subject to its conditions. It is not proof of acceptance for Growth's account. “Not identified” means the clauses were not found in the documents reviewed, without implying that the provider cannot offer a separate addendum. “Not established” means the available documentation does not establish their inclusion.

Establishing contractual coverage requires identifying the agreement applicable to the account and service, the DPA version and how it was incorporated or accepted, and any separate addendum containing ANPD standard contractual clauses. This list does not replace those instruments or establish coverage for every account. The analysis above is limited to the eleven listed providers; it does not establish ANPD clause coverage for DeepInfra, Microsoft, or the integrations in section 2.

Coverage of both CNPJs: reviewing supplier agreements must establish which Growth Machine company is covered. Listing both companies here does not automatically extend a DPA or transfer clauses entered into by one company to the other; coverage must follow from the applicable agreement, an affiliate provision, or a corresponding instrument.

European clauses, security certifications, and general references to the LGPD do not automatically equate to ANPD standard contractual clauses. Other transfer mechanisms require their own applicable basis under ANPD guidance on international transfers.

---

2. Controller-Enabled Integrations

The following third-party services are optionally configured by the Project (Controller) and process Lead data when enabled. Growth Machine acts as a technical intermediary; the Controller is responsible for its contractual relationship with each provider.

---

3. Adding New Subprocessors

1. Growth Machine assesses the prospective subprocessor's security and privacy practices.
2. Growth Machine enters into a DPA with the new subprocessor.
3. This document is updated to include the new subprocessor.
4. Controllers receive at least 30 (thirty) days' notice before activation.
5. A Controller may submit a reasoned objection within 15 days.

---

4. Objection Procedure

If a Controller has a reasoned objection to a new subprocessor:

1. The Controller must submit its objection in writing within 15 (fifteen) days after receiving notice.
2. Growth Machine will seek a reasonable alternative or mitigating measure.
3. If the objection cannot be resolved, the Controller may terminate the Main Agreement and DPA without penalty, subject to a 30-day transition period.

---

5. Contact

For questions about subprocessors:

• Email: privacidade@growthedge.com.br
• Data Protection Officer (DPO): Natália Caroline Batista

---

This document forms part of the Growth Station DPA and Privacy Policy.

Your feedback matters

Did this guide answer your question?

It only takes a few seconds and helps us keep the knowledge base useful.

YesIt answered my questionNoIt could be improved