Point Subprocessor and Connected Service Provider List
Version: 1.1
Effective date: October 5, 2026
Entity: American River Tech Solutions, Inc, a Delaware corporation, DBA “Point”, with primary offices in California.
Privacy contact: privacy@getpoint.ai
Website: getpoint.ai
This list distinguishes Subprocessors, Connected Service Providers, and controller-side advertising / marketing vendors.
A Subprocessor is a third party Point engages to process Customer Personal Data on Point’s behalf to provide the Services. A Connected Service Provider is a third-party account or platform that a Customer or User authorizes Point to access or interact with; it is not a Subprocessor for those functions. A controller-side advertising / marketing vendor is a provider Point uses for its own websites, marketing, advertising, and measurement. A provider may appear in more than one category for different roles.
Not every provider is used for every Customer. Use may depend on plan, region, features, integrations, and configuration. Point updates this list from time to time as providers are added, replaced, or removed.
1. Subprocessors
| Provider | Purpose | Categories of data | Location |
|---|---|---|---|
| Amazon Web Services, Inc. | Cloud infrastructure, hosting, storage, and related operational services | Customer Content, account data, and related service data | United States |
| Anthropic, PBC, or the applicable Anthropic contracting entity | AI processing, including AI-assisted features and web search | Prompts, excerpts of Customer Content and connected-account content, AI Output, and related metadata | United States |
| OpenAI OpCo, LLC / OpenAI Ireland Ltd., as applicable | AI processing, including real-time voice features | Prompts, excerpts of Customer Content, voice audio and transcripts when voice is used, AI Output, and related metadata | United States |
| Voyage AI Innovations, Inc. | Embeddings and search ranking | Excerpts of Customer Content and connected-account content, search queries, resulting embeddings and scores, and related metadata | United States |
| Google LLC (Firebase Cloud Messaging) | Mobile push-notification delivery | Device push tokens and notification content, which may include message-derived snippets | United States / global |
| Plus Five Five, Inc. (d/b/a Resend) | Transactional email delivery | Recipient names and email addresses, and transactional message content | United States |
| Stripe, Inc. | Payment processing and subscription billing | Billing contact details, payment information (handled by Stripe), and subscription records | United States / global |
| Cloudflare, Inc. | Website hosting, content delivery, and edge network services | Visitor IP addresses and request metadata | Global |
AI and embedding providers are used under business or API terms that restrict their use of submitted data, including for model training, where available.
Controller-side advertising vendors are listed in Section 3 unless they also process Customer Personal Data on Point’s behalf.
2. Connected Service Providers (user- or Customer-authorized)
These providers act on the Customer’s or User’s authorization for connected-account functions. They are not Point subprocessors for those functions.
| Provider | Integration role | Data involved |
|---|---|---|
| Google LLC — such as Gmail, Google Calendar, Google Drive, and Google Sign-In | Authorized access to email, calendar, and Google Drive files, identity, and change notifications, as the user permits | Email, calendar, and file content and metadata, identity and profile information, granted permissions, and sync information |
| Microsoft Corporation — such as Outlook, Microsoft 365, OneDrive, and Microsoft Entra ID | Authorized access to email, calendar, and OneDrive files, identity, and change notifications, as the user permits | Email, calendar, and file content and metadata, identity and profile information, granted permissions, and sync information |
| Dropbox, Inc. | Authorized access to Dropbox files and folders and change notifications, as the user permits | File content and metadata, account identifiers, granted permissions, and sync information |
Google is a Subprocessor only where Point uses a Google service as a Point-controlled provider (see Section 1); Microsoft and Dropbox likewise only if Point engages them as Point-controlled providers.
3. Controller-side advertising, analytics, and marketing vendors
These vendors support Point’s own websites, campaigns, and measurement. They are not Subprocessors for Customer Content.
| Provider | Purpose | Data processed or made available | Treatment |
|---|---|---|---|
| Google LLC, Google Ireland Limited, or another applicable Google affiliate | Advertising, analytics, and measurement, through products such as Google Ads and Google Analytics where enabled | Website and marketing-property activity, device and approximate location information, cookie and advertising identifiers, campaign and conversion information, and Point-controlled relationship information where lawful | Google’s role depends on product and configuration. Customer Content and connected-account data, including Google API data, are not used or disclosed for Google advertising, retargeting, audience building, or advertising profile creation. |
4. Classification rule
Point lists a provider as a Subprocessor when Point engages it to process Customer Personal Data for Point-controlled service delivery, such as hosting, AI processing, search, notifications, payments, or transactional email.
Point lists a provider as a Connected Service Provider when a Customer or User has an account with that provider and authorizes Point to access or act on data in it, such as Gmail, Google Drive, Outlook, OneDrive, or Dropbox.
A provider can appear in several categories. For example, Google is a Connected Service Provider for Gmail, Google Calendar, and Google Drive; a Subprocessor for push-notification delivery; and a controller-side vendor for Point’s own advertising and measurement.