Sub-processors
ProspeQ is operated by NovaSQ Pty Ltd (ABN 34 693 165 114) trading as ProspeQ. We use the third-party providers below to deliver the service. We give customers at least 30 days' notice (by email and on this page) before adding a new sub-processor that handles customer or prospect personal information.
Data location: customer and prospect data is stored on Australian servers - a primary server in Melbourne and an encrypted offsite replica, both located in Australia - and our backups are also held in Australia. The only data that goes overseas is content sent to the AI, web-search, payment and CDN providers below. (A CRM you connect, such as HubSpot or Pipedrive, is a source we collect from at your direction - we do not send your data to it; see the connections note below.)
| Sub-processor | Purpose | Data it may receive | When | Location |
|---|---|---|---|---|
| OpenAI | AI research / scoring / drafting (the platform default) | Prompt content, which can include prospect business-context information | Always (default AI provider) | United States |
| Anthropic (Claude)BYOK only | AI research / scoring / drafting | Prompt content, as above | Only if a customer brings their own Anthropic key (BYOK) | United States |
| Google (Gemini)BYOK only | AI research / scoring / drafting | Prompt content, as above | Only if a customer brings their own Google key (BYOK) | United States |
| Serper | Web-search API used during research | Search queries (e.g. company/role terms) | During research | United States |
| Stripe | Payments and subscription billing | Billing/customer metadata and card data (card data handled entirely by Stripe; it does not reach NovaSQ) | At billing | United States / global |
| Cloudflare | CDN, TLS termination and secure edge | Network/traffic metadata; TLS may terminate at the nearest edge (may be outside Australia for non-AU visitors) | Always | Global edge |
AI access model
By default, AI runs on a ProspeQ-managed key using OpenAI. A customer may instead bring their own provider key (BYOK) and use OpenAI, Anthropic (Claude) or Google (Gemini) under their own provider account - in which case that provider becomes a recipient for that customer.
Customer-authorised connections (HubSpot, Pipedrive)
HubSpot and Pipedrive are optional data sources you choose to link to your own account - not sub-processors we send your data to. They are not used unless you connect them. The data flow is one-way inbound: when you connect HubSpot, ProspeQ imports the contacts and companies you select from your own HubSpot account into your workspace. The only thing sent to the provider is the standard OAuth authorisation to read your account; we do not push your ProspeQ data out to them. You can disconnect at any time from Settings.
Backups
Backups are taken to encrypted storage held in Australia, including an encrypted offsite copy at a second Australian location; we do not use an overseas backup provider.
Overseas handling
The AI providers, payment processor and CDN above operate (in whole or part) outside Australia, mainly in the United States. We do not represent that all processing happens in Australia. We require sub-processors, by contract, to protect personal information consistently with applicable law and to use it only to provide their service to us.
Questions
For questions about this list or to request our Data Processing Agreement, email info@prospeq.com.au.