Gridheart Sub-processors
Version 2026-11, effective 7 December 2026. Replaces version 2026-10. No Sub-processor has been added or replaced.
This list sets out the Sub-processors that Gridheart AB engages to process Partner Personal Data under Section 6 of the Gridheart Data Processing Terms.
Vendors of Third-party Products, such as Microsoft, Acronis and Bitdefender, are not Gridheart Sub-processors. They process data in their own products under their own terms with You or Your Customers, as set out in Section 1.4 of the Data Processing Terms. Information about where a Vendor processes data is available in that Vendor's own terms and documentation.
When You activate the Microsoft 365 integration, Gridheart itself reads and administers data in Your Customers' Microsoft 365 tenants through Microsoft's interfaces, as described in Appendix 3 of the Data Processing Terms. That data stays in the Customer's tenant, which Microsoft provides to the Customer under the Customer's own agreement with Microsoft. Microsoft does not process that data on Gridheart's behalf and is not a Gridheart Sub-processor for it.
Platform
| Sub-processor | Purpose | Location |
|---|---|---|
| Lovable Labs Incorporated (EU contact: Lovable Labs AB, Stockholm, Sweden) | Hosting, database, backend functions, email delivery and AI features of the Gridheart Platform, including the AI models that Lovable makes available to the Platform. Lovable's own sub-processors are listed in Lovable's data processing agreement | Platform database hosted in the EU. Lovable Labs Incorporated is established in the USA |
Gridheart operations
| Sub-processor | Purpose | Location |
|---|---|---|
| Anthropic PBC | AI-assisted analysis, content generation and support | USA |
| Fortnox AB | Accounting and invoicing | Sweden (EU) |
| Google Ireland Ltd | Email, file storage and collaboration (Google Workspace) | Ireland (EU) / USA |
| Halo Service Solutions Ltd (HaloPSA) | Customer support and ticket management | United Kingdom |
| Microsoft Ireland Operations Ltd | Email, file storage and collaboration (Microsoft 365) | Ireland (EU) / USA |
| OpenAI OpCo LLC | AI-assisted content generation and analysis | USA |
| Pipedrive OÜ | CRM and sales pipeline management | Estonia (EU) / USA |
Transfers outside the EU/EEA
Where a Sub-processor processes Partner Personal Data outside the EU/EEA, the transfer is protected in accordance with Section 7 of the Data Processing Terms, for example by the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.
Changes to this list
Gridheart informs partners of intended additions or replacements at least thirty (30) days in advance, by updating this list and notifying partners in the Platform or by email, in accordance with Section 6.3 of the Data Processing Terms. Partners may object within five (5) calendar days of the notice under Section 6.4. Questions can be sent to privacy@gridheart.com.
Previous versions: 2026-10, 2026-03, 2018-05.