Point Subprocessor and Connected Service Provider List
Version: 1.0
Effective date: July 7, 2026
Entity: Advanced Mail Solutions, Inc., a Delaware corporation, DBA “Point”, with primary offices in California.
Privacy contact: privacy@getpoint.ai
Website: getpoint.ai
This document is an initial transparency list for Point. It distinguishes Subprocessors, Connected Service Providers, and controller-side advertising / marketing vendors.
A Subprocessor is a third party engaged by Point to process Customer Personal Data on Point’s behalf to provide the Services. A Connected Service Provider is a third-party account, platform, or provider that Customer or a User authorizes Point to access, read from, write to, subscribe to, or otherwise interact with. A controller-side advertising / marketing vendor is a provider Point uses for Point’s own public websites, marketing, advertising, attribution, analytics, retargeting, or campaign measurement. A provider is not a Subprocessor solely because Customer or a User connects an account there or because Point uses that provider for Point-controller marketing activities outside Customer Content processing.
Not every listed provider is used for every Customer. Use depends on plan, region, model routing, integrations, support interactions, and technical configuration.
1. Subprocessors — initial list
| Provider | Classification | Role / purpose | Data processed | Notes |
|---|---|---|---|---|
| Amazon Web Services, Inc. | Subprocessor | Cloud infrastructure, hosting, storage, databases, networking, logs, backups, security, and operational services. | Customer Content, account data, metadata, service logs, files, indexes, embeddings, summaries, points, prompts, outputs, and related service data. | Cloud infrastructure subprocessor when AWS hosts or supports Point Services. |
| Anthropic, PBC, or the applicable Anthropic contracting entity | Subprocessor | AI and LLM processing. | Prompts, connected-account excerpts, Customer Content excerpts, AI Output, metadata, and operational telemetry needed for AI features. | Used under business/API terms with no-training controls where available. |
| OpenAI OpCo, LLC / OpenAI Ireland Ltd., as applicable | Subprocessor | AI and LLM processing, including real-time voice interaction. | Prompts, connected-account excerpts, Customer Content excerpts, voice audio and voice transcripts when voice mode is used, AI Output, metadata, and operational telemetry needed for AI features. | Used under business/API terms with no-training controls where available. |
| Google LLC / Google Cloud, as applicable | Subprocessor for Point-controlled AI / cloud use | Text-embedding generation through the Google Generative AI API (model gemini-embedding-2) for semantic search and related AI features. | Text excerpts of Customer Content and connected-account content submitted for embedding, resulting embeddings, metadata, and operational telemetry needed for the embedding service. | Google is also a Connected Service Provider for Gmail/Calendar/OAuth functions; that role is separate. |
| Google LLC (Firebase Cloud Messaging) | Subprocessor | Mobile push-notification delivery. | Device push tokens and notification payload fragments, which may include message-derived snippets. | United States / global. Separate from Google’s Connected Service Provider and embedding roles. |
| Plus Five Five, Inc. (d/b/a Resend) | Subprocessor | Transactional email delivery, including verification, notification, and waitlist emails. | Recipient names and email addresses, and the content of transactional messages. | United States. |
| Stripe, Inc. | Subprocessor | Payment processing and subscription billing. | Billing name and email address, payment method details (card data is handled by Stripe directly), and subscription records. | United States / global. Point does not store full payment card numbers. |
| Cloudflare, Inc. | Subprocessor | Marketing-website hosting, content delivery network, and edge network services. | Website visitor IP addresses and request metadata. | Global network. |
Controller-side advertising vendors used only for Point’s own marketing properties are listed in Section 3 instead of Section 1 unless they also process Customer Personal Data on Point’s behalf for the Services. Point updates this list from time to time as vendors are added, replaced, or removed.
2. Connected Service Providers / customer-authorized recipients
| Provider | Classification | Integration role | Data involved | Treatment |
|---|---|---|---|---|
| Google LLC, including Gmail, Google Calendar, Google Sign-In, Google OAuth, Google Workspace APIs, and related Google services | Connected Service Provider — acts on the customer’s or user’s instruction for connected-account functions; not a Point subprocessor for those functions | User- or Customer-authorized integration for reading/syncing email and calendar data, sending/writing content, identity/profile access, OAuth, and event or push subscriptions. | Emails, headers, recipients, attachments, labels/folders, calendar events, availability, participants, identity/profile information, OAuth scopes, provider identifiers, sync state, and event subscription data. | Disclosed as a Connected Service Provider / authorized recipient. Google is a Subprocessor only when Point uses Google as a Point-controlled AI, cloud, infrastructure, or operational provider (see Section 1). |
| Microsoft Corporation, including Microsoft 365, Outlook, Exchange Online, Microsoft Graph, Microsoft Entra ID, Microsoft OAuth, Outlook Calendar, and related Microsoft services | Connected Service Provider — acts on the customer’s or user’s instruction for connected-account functions; not a Point subprocessor for those functions | User- or Customer-authorized integration for reading/syncing email and calendar data, sending/writing content, identity/profile access, OAuth, and webhook/change-notification subscriptions. | Emails, headers, recipients, attachments, folders, calendar events, availability, participants, identity/profile information, OAuth scopes, provider identifiers, sync state, and event subscription data. | Disclosed as a Connected Service Provider / authorized recipient. Microsoft is a Subprocessor only when Point uses Microsoft as a Point-controlled cloud, AI, identity, support, infrastructure, or operational provider. |
3. Controller-side advertising, analytics, and marketing vendors
These vendors are disclosed for transparency because Point may use them for Point-controlled public websites, landing pages, campaigns, attribution, analytics, retargeting, audience creation or exclusion, and campaign measurement. They are not Subprocessors for Customer Content merely because Point uses them for Point’s own marketing or advertising.
| Provider | Vendor category | Role / purpose | Data processed or made available | Treatment |
|---|---|---|---|---|
| Google LLC, Google Ireland Limited, or another applicable Google affiliate | Advertising, analytics, measurement, attribution, retargeting, and marketing technology | Google Ads, Google Analytics, Google Tag, Google Tag Manager, Google Ads conversion tracking, remarketing tags, Enhanced Conversions, Customer Match, Campaign Manager, Display & Video 360, Search Ads 360, or comparable Google advertising and measurement services where enabled. | Public website or marketing-property activity, URL/referral information, IP address, approximate location, device/browser information, cookie or advertising identifiers, campaign identifiers, conversion events, demo/trial/account/plan events, hashed business contact information, and opt-out, suppression, or audience-exclusion records. | Controller-side advertising / marketing vendor. Google’s role depends on product and configuration and may include independent controller, controller-controller partner, processor, service provider, or restricted-processing role. Customer Content, connected-account data, Google API data, Microsoft connected-account data, prompts, outputs, embeddings, summaries, points, OAuth tokens, email content, calendar content, files, and attachments must not be used or disclosed for Google advertising, retargeting, Customer Match, enhanced conversions, or advertising profile creation. |
4. Practical classification rule
Point lists a provider as a Subprocessor when Point chooses and engages that provider to process Customer Personal Data for Point-controlled service delivery, such as cloud hosting, LLM processing, embeddings, logging, support, security, payments, or transactional communications.
Point lists a provider as a Connected Service Provider / authorized recipient when the Customer or User already has an account with that provider and authorizes Point to access or act on data in that account, such as Gmail, Google Calendar, Outlook, Microsoft 365, Microsoft Graph, Google OAuth, or Microsoft OAuth.
A provider can appear in multiple categories for different processing roles. Google is the clearest example: Google is a Connected Service Provider for Gmail and Google Calendar integrations; a Subprocessor if Point uses the Google Generative AI API for embeddings, Google Cloud, or other Point-controlled service processing; and a controller-side advertising / marketing vendor if Point uses Google Ads, Google Analytics, Google Tag Manager, Customer Match, Enhanced Conversions, or similar Google advertising and measurement products for Point’s own public websites and campaigns.