Subprocessors
Last updated: 5 October 2026
ClearMyInbox (operated by Clear My Inbox LTD) uses the third-party processors listed below to deliver the service. We publish this list so you can see exactly who touches your data, what they do with it, and where they operate. Anything not on this list does not handle your data.
When we add a subprocessor or materially change the role of an existing one, we update this page and the date above. Axiom was added on 16 September 2026 as a second destination for telemetry we were already collecting; nothing new about you is recorded because of it. Hookdeck was added on 1 October 2026 to monitor the delivery of Stripe payment notifications.
Current subprocessors
Microsoft Azure
- Purpose:
- Application hosting (Container Apps), database (Azure SQL), secrets (Key Vault), container registry (ACR), and observability (Log Analytics, App Insights).
- Region:
- UK South (primary), with geo-redundant backup storage.
Azure Communication Services (Microsoft)
- Purpose:
- Transactional, service and product email delivery (password reset, account verification, dormancy notices, scheduled scan reports, and product emails such as the results of your clean-up). Plain-text + HTML payloads. The one exception to "no third party" is the scheduled scan report, which is BCC'd to Trustpilot (a disclosed subprocessor, below) so we can invite you to review the service; no other email touches a third party.
- Region:
- EU (Ireland / Netherlands).
Stripe Payments Europe
- Purpose:
- Subscription billing, checkout, customer portal, and webhooks. We never see card numbers, CVVs, or bank details - those flow directly from your browser to Stripe.
- Region:
- EEA + US (Stripe is a global processor; EEA traffic is processed under the SCCs in their DPA).
Hookdeck Technologies Inc.
- Purpose:
- Delivery monitoring for Stripe payment notifications. Hookdeck receives a copy of each notification Stripe sends us about a subscription or payment, so we can see whether it was delivered. A notification can include your name, email address, billing address, the plan and amount, and for a refund the card brand, last four digits and expiry date - never the full card number or security code. Hookdeck does not handle payments and does not send anything on to us; Stripe still sends every notification straight to us.
- Region:
- United States. Data from the European Economic Area is covered by the standard contractual clauses in Hookdeck's DPA.
- Invoked when:
- You start, change, or cancel a paid plan, a payment is taken or fails, or a payment is refunded.
OpenRouter
- Purpose:
- AI inference proxy. Routes Pro-tier spam-scoring and unsubscribe-link-extraction prompts to upstream models (currently Google Gemini and DeepSeek). We never send email body content for spam scoring - only sender, subject, and count. The link-extraction fallback sends up to 2,000 chars of HTML body solely to identify an unsubscribe URL.
- Region:
- US (with upstream model providers in US/EU).
Axiom
- Purpose:
- Application logs and traces (a second observability sink alongside Azure Monitor, so an App Insights outage or daily cap does not leave us blind). Receives what our own logging emits: request paths and timings, background-job progress, sender domains, and pseudonymous account ids. Never email content, addresses, OAuth tokens, or passwords.
- Region:
- US (AWS us-east-1; Axiom is a US processor and EEA/UK traffic is processed under the SCCs in their DPA).
- Invoked when:
- Always on: every API request and background job emits telemetry.
PostHog
- Purpose:
- Product analytics in cookieless mode. Pseudonymous events for page views and feature usage. No PII, no cross-site tracking.
- Region:
- EU (PostHog EU cloud).
Trustpilot
- Purpose:
- Review collection. When you receive a scheduled scan report, your email address is shared with Trustpilot (as a BCC on that report) so Trustpilot can invite you, about a week later, to review ClearMyInbox. Only your email address is shared - never your inbox contents, senders, or scan results. Each invitation carries Trustpilot's own opt-out. We rely on legitimate interest for this post-service review request.
- Region:
- EU (Denmark) + US (Trustpilot is a global processor; EEA traffic is processed under the SCCs in their DPA).
- Invoked when:
- You receive a scheduled scan report (Pro feature) with email reports enabled.
Cloudflare
- Purpose:
- DNS, CDN, and inbound email routing (support@ / privacy@ aliases). No application data passes through Cloudflare; it sits in front of the static site and forwards email for our team aliases.
- Region:
- Global anycast network.
- Purpose:
- Gmail OAuth and Gmail API. Only invoked when you choose to connect a Gmail account. Google sees the OAuth consent, returns access + refresh tokens, and serves Gmail API requests for scans.
- Region:
- US (Google global infrastructure).
- Invoked when:
- You connect a Gmail account.
Microsoft (Entra ID + Microsoft Graph)
- Purpose:
- Outlook OAuth and Microsoft Graph Mail API. Only invoked when you choose to connect an Outlook / Hotmail / Live account. Same shape as the Gmail flow above.
- Region:
- EU + US (Microsoft global infrastructure).
- Invoked when:
- You connect an Outlook / Hotmail / Live account.
Yahoo
- Purpose:
- IMAP endpoint for Yahoo accounts. Connection is via your app password (Yahoo issued, stored encrypted by us). Yahoo processes the IMAP requests to serve your message headers during a scan.
- Region:
- US (Yahoo global infrastructure).
- Invoked when:
- You connect a Yahoo account via IMAP.
Where subprocessors are NOT invoked
- If you connect only a Yahoo IMAP account, your data never flows to Google or Microsoft for that account.
- If you stay on the Free tier and never trigger the AI-assisted features, no data is sent to OpenRouter.
- If you never subscribe, no data is sent to Stripe beyond what is needed to render the pricing page.
Related
- Privacy policy - the full data-handling policy this page supplements.
- Security - how we secure your data in transit and at rest.
- Contact - if you have questions about any processor on this list.