Data processing at Connecto
Last updated: 2026-10-29
Who we are
Connecto is provided by ARX S.r.l., Via Pellegrino Matteucci 24, 40137 Bologna, Italy, VAT number and tax code 04384231207. Write to us at [email protected].
The people you contact: our shared responsibility
For the personal data of the people a student's campaigns contact, the student and ARX S.r.l. are joint controllers under Article 26 of the GDPR. The student chooses the goal of each campaign and approves the message model of each group, shown with examples filled in for real people, and every reply; the messages go out from the student's own LinkedIn account. We provide the service and publish the information those people are entitled to in the section «People contacted through Connecto» of our Privacy Policy. The basis is the legitimate interest, the student's and ours, in professional networking (Article 6(1)(f) of the GDPR). The agent reads a student's LinkedIn conversations only with the people in the student's campaigns, and every campaign honours the student's «never contact» list. We keep those people's data while the campaign and the student's account exist, and delete it earlier when the person asks. A person contacted can exercise their rights with either of us.
Who processes data for us
| Provider | What for | Company | Role | Where | Transfers outside the EEA |
|---|---|---|---|---|---|
| Anthropic (Claude) | the AI models that run the agent | Anthropic Ireland, Limited | processes data for us | stored in the United States; processed on Anthropic's global routing (the US, Europe, Asia or Australia) | Standard Contractual Clauses (Decision (EU) 2021/914), as incorporated in Anthropic's DPA |
| OpenAI | the fallback AI models when Anthropic is unavailable | OpenAI Ireland Ltd | processes data for us | OpenAI's affiliates and cloud providers in the United States and other countries | Standard Contractual Clauses or an adequacy decision, as OpenAI's DPA states |
| Supabase | the database, sign-in, file storage | Supabase Pte. Ltd. (Singapore) | processes data for us | stored and primarily processed in the project's region, the EU (Frankfurt); Supabase or its sub-processors may process it elsewhere | Standard Contractual Clauses, Module 2 (Irish law) |
| Stripe | payments, checkout, the customer portal and tax | Stripe Payments Europe, Limited (Ireland), with Stripe Technology Europe, Limited for regulated payment services | processes data for us, and is its own controller for its own purposes | transferred to Stripe, LLC in the United States, and to Stripe's affiliates and sub-processors | the EU-U.S. Data Privacy Framework, otherwise the Standard Contractual Clauses |
| Resend | sending the service's emails, the sign-in codes included | Plus Five Five, Inc. (United States) | processes data for us | the United States (all data, including email logs) | Standard Contractual Clauses and the EU-U.S. Data Privacy Framework |
| Vercel | hosting the app; web analytics and speed insights | Vercel Inc. (United States) | processes data for us | functions in Frankfurt (fra1); Vercel's primary processing facilities in the United States | Standard Contractual Clauses (DPA) and the EU-U.S. Data Privacy Framework |
| Inngest | running the agent's background jobs | Inngest Inc (United States) | — | the United States | — |
| Sentry | error tracking | Functional Software, Inc. d/b/a Sentry (United States) | processes data for us | the United States or the EU (Frankfurt), as set when the account was created; some account data always in the United States | the EU-U.S. Data Privacy Framework, otherwise the Standard Contractual Clauses |
| PostHog | product analytics, only after consent, every text masked | PostHog, Inc. (United States) | processes data for us | its EU Cloud (Frankfurt), with processing also in the United States | the EU-U.S. Data Privacy Framework and the Standard Contractual Clauses |
| Unipile | acting on the student's LinkedIn account (sign-in, search, invitations, messages) | UNIPILE SAS (France) | processes data for us | France (Scaleway, OVHcloud); network providers in the United States, Singapore and Israel | within the EEA; its providers: Standard Contractual Clauses (US, Singapore), an adequacy decision (Israel) |
| iubenda | the cookie banner and its consent records, the legal documents | iubenda s.r.l. (Milan) | processes data for us | the EU/EEA | none needed for iubenda's own processing (EU/EEA) |
| Google Analytics and Google Tag Manager | measuring how the site is used, only after consent | Google Ireland Limited | processes data for us | EU traffic collected on EU servers; Google's facilities worldwide; EU users' IP addresses not logged or stored | the EU-U.S. Data Privacy Framework, otherwise the Standard Contractual Clauses |
| Google sign-in | signing in with a Google account | Google (Google LLC's API terms; the account is controlled by Google Ireland Limited for EEA users) | its own controller | Google's own, under its privacy policy | Google's own, under its privacy policy |
| Google Workspace | Connecto's mailbox ([email protected]) | — | — | — | — |
| Cloudflare | the domain's network protection and the bot check (Turnstile) | Cloudflare, Inc. (United States) | processes data for us, and is its own controller for its own purposes | may process outside the EEA; its own data primarily in the United States and the EEA | the EU-U.S. Data Privacy Framework, otherwise the Standard Contractual Clauses |
| LinkedIn (your contacts' profile photos) | showing each contact's profile photo in Contacts: your browser loads it from LinkedIn's image server, which receives your IP address and browser details | LinkedIn Ireland Unlimited Company | its own controller | LinkedIn's own, under its privacy policy | LinkedIn's own, under its privacy policy |
Changes to this list
When a provider joins or leaves this list, we update this page and its date.