In short: When your charter company uses the Atlas Platform, Sail Atlas processes your guests’, crew’s, staff’s and other contacts’ personal data on your behalf, under our Data Processing Agreement. To do this we use the service providers listed below (sub-processors). Your data is stored by Amazon Web Services in Frankfurt, Germany; some providers are in the United States. We tell you at least 30 days before we add or replace a sub-processor.
1. About this list
1.1 This page lists the sub-processors that may process Customer Personal Data on behalf of HeyAtlas.ai LLC (Sail Atlas) when we provide the Atlas Platform: Atlas Dashboard, Atlas Operations, Digital Offers, Direct Booking Websites, Crew List and Atlas AI, and the parts of Atlas Charter, Atlas Crew and Atlas Owner that show your data to the people you work with.
1.2 This page is Annex 3 of the Data Processing Agreement (“DPA”). Terms used here have the meanings given in the DPA.
1.3 Each sub-processor processes Customer Personal Data only to provide its service to us, under a written contract with data protection and security obligations no less protective than those in the DPA. We remain liable to you for their work.
1.4 This page does not cover providers we use for our own purposes as a controller, for example for our website, demo bookings or our own billing. These are described in our Privacy Policy.
2. Sub-processors used for all customers
Some of these providers are used only when your users use the related feature, as shown in the “Purpose” column.
| Sub-processor | Purpose | Data concerned | Location | Transfer safeguard |
|---|---|---|---|---|
| Amazon Web Services, Inc. | Hosting: servers, database, file storage, search, backups; email sending (Amazon SES); machine translation (Amazon Translate) | All Customer Personal Data | Germany (Frankfurt, eu-central-1) | Data stored in the EEA. For any access from outside the EEA: SCCs in the AWS DPA; DPF |
| Laravel Holdings Inc. (Forge, Envoyer) | Server management and software deployment | No routine access to Customer Personal Data; technical access to the servers we manage through it | United States | SCCs (Module 3); DPF where certified |
| Cloudflare, Inc. | Domain name system (DNS) and network security | IP addresses and request data passing through its network | Global | SCCs (Module 3); DPF where certified |
| Functional Software, Inc. (Sentry) | Error and performance monitoring | Technical error data, which may include user IDs, IP addresses and request details; sensitive fields are removed or masked before sending | EU (Germany) | Data stored in the EEA. For any access from outside the EEA: SCCs; DPF where certified |
| Microsoft Corporation (Clarity) | Usage analytics and session recording of the Platform’s web and mobile apps, only for users who consent | Usage events, device and browser data, screen recordings with on-screen text masked | United States | SCCs (Module 3); DPF where certified |
| Google LLC (Cloud Translation) | Translation of messages and content when your users use translation | The text to be translated | United States | SCCs (Module 3); DPF where certified |
| Google LLC (Firebase Cloud Messaging) | Delivery of push notifications to Android devices | Device push tokens and notification content | United States | SCCs (Module 3); DPF where certified |
| 650 Industries, Inc. (Expo) | Sending push notifications to the mobile apps, through Apple Push Notification service and Firebase Cloud Messaging | Device push tokens and notification content (which may include a short preview of a message) | United States | SCCs (Module 3); DPF where certified |
| OpenAI, L.L.C. | Atlas AI: assistant, drafting, summarising and voice transcription, when your users use these features | The inputs your users send (questions, messages, notes, documents, voice recordings) and the outputs | United States | SCCs (Module 3); DPF where certified |
| Anthropic, PBC | Atlas AI: assistant and translation, when your users use these features | The inputs your users send and the outputs | United States | SCCs (Module 3); DPF where certified |
| Base64.ai | Reading data from passport and ID images, when document scanning is used | Images of passports and ID documents and the data read from them | United States | SCCs (Module 3); DPF where certified |
| Twilio Inc. | Sending and receiving WhatsApp messages and SMS from your inbox and campaigns | Phone numbers, names, message content and attachments; messages are delivered through WhatsApp (Meta) and mobile networks | United States | SCCs (Module 3); DPF where certified |
For customers in Türkiye, transfers abroad to these sub-processors rely on the KVKK Standard Contract (processor-to-processor module) or another appropriate safeguard under Article 9 of the KVKK, as described in section 9.4 of the DPA.
3. Sub-processors used only if you turn them on
These providers process Customer Personal Data only if you connect the related integration or use the related feature. You connect them under your own account with the provider, and the provider’s own terms with you also apply.
| Sub-processor | Purpose | Data concerned | Location | Transfer safeguard |
|---|---|---|---|---|
| Intuit Inc. (Mailchimp) | Sending your email campaigns, if you connect your Mailchimp account | Recipients’ names, email addresses, consent status and campaign content; delivery and engagement data | United States | SCCs (Module 3); DPF where certified |
| Google LLC (Gmail) | Sending your email campaigns and messages from your own Gmail or Google Workspace account, if you connect it | Recipients’ names and email addresses, message content | United States | SCCs (Module 3); DPF where certified |
| Google LLC (Google Calendar) | Adding events to a connected Google Calendar, if the calendar connection is used | Event dates and the booking or request details shown in the event | United States | SCCs (Module 3); DPF where certified |
4. Integrations you contract directly
4.1 The Platform can connect to services that you choose and contract with directly. These providers are not Sail Atlas sub-processors. They act for you under your own agreement with them, and that agreement governs how they process personal data. When you connect them, you instruct us to exchange data with them as needed for the integration to work (section 16.5 of the DPA).
| Service | What the integration does |
|---|---|
| Booking systems: BookingManager (MMK) and NauSYS | Syncing boats, availability and bookings, including the charterer’s name and email address |
| Payment providers: Param, PayTR and iyzico | Taking online payments on your Direct Booking Website. Guests enter card details with the payment provider; Sail Atlas does not store card numbers or security codes |
4.2 You are responsible for having an appropriate contract with these providers and, where needed, for putting in place transfer safeguards for data you send to them.
5. Changes to this list and how to be notified
5.1 We tell you at least 30 days before we add or replace a sub-processor. We send the notice by email to the account owner and the administrator contacts on your account and update this page. In urgent cases, for example for security reasons, we may give shorter notice, as set out in section 8.5 of the DPA.
5.2 Anyone else who wants to receive these notices, for example your data protection contact, can subscribe by emailing info@sailatlas.app with the subject “Sub-processor updates” and your company name.
5.3 You may object to a new sub-processor within 30 days of our notice, as set out in section 8.4 of the DPA.
5.4 Last updated: 4 October 2026.
6. Contact
For questions about our sub-processors, write to info@sailatlas.app or to HeyAtlas.ai LLC, 2037 Lemoine Ave, Suite 330, Fort Lee, NJ 07024, United States.