# Vendor snapshot — email, chat, embeds, forms, workplace

**Snapshot date: 2026-08-05**, read from each vendor's own current legal or documentation pages. **A lead, not a finding.** Re-verify and re-date before use.

**No DPF status below was verified** against `dataprivacyframework.gov/list`; every DPF line is vendor self-assertion. Look the exact entity up yourself — `transfers.md`. Infrastructure, analytics, payments and ad platforms: `vendors.md`. LLM APIs: `ai-vendors.md`.

## Transactional e-mail

Cross-cutting: **CNIL's recommendation of 14.04.2026 on e-mail tracking pixels** requires consent by default for open and click tracking, with narrow deliverability and security exemptions — see `enforcement.md`. The per-vendor default below is therefore a compliance fact, not a preference.

**Resend** — Plus Five Five, Inc., US, no EU entity. **Split role**: DPA § 2.1 processor for Customer Data, § 9.1 "**independent controller, not a joint controller**" for Account and Usage Data. § 6.1: "primary processing operations take place in the United States"; no EU region. SCC Modules One, Two and Three, UK Addendum, Swiss amendments; DPF asserted. DPA `resend.com/legal/dpa` (31.12.2025) **auto-incorporated**. Sub-processors `resend.com/legal/subprocessors` (15.07.2026), 22 entities including Anthropic; **14 days' notice, 14 days to object**, silence is acceptance, sole remedy is discontinuing the service. **Open and click tracking are off by default** ("disabled by default for all domains"); opens use a 1×1 GIF, clicks rewrite links. No numeric retention. *Gotcha:* the cookie policy is dated **July 2024** and predates both the DPF claim and the tracking-pixel feature — it understates the footprint.

**Postmark / ActiveCampaign** — Postmark's DPA names **AC PM LLC** (US); ActiveCampaign Ireland Limited appears only in the group privacy policy, **not as the Postmark contracting party**. Processor. **EU hosting explicitly refused**: "We currently don't have plans to add servers in the EU"; servers are Deft (Chicago) and AWS. SCC Modules Two and Three, UK Addendum, DPF asserted. **The incorporation split is the trap**: Postmark's DPA is auto-incorporated, ActiveCampaign's is **not** — "You must execute a DPA with ActiveCampaign in order for the DPA to be legally binding", via account settings. Postmark sub-processors: three entities (Deft, AWS, Zendesk), **7 days to object**. Retention: "in accordance with AC PM's data retention schedule" — **no numeric value on any live page**. Open/click default unstated. *Gotcha:* Postmark has no separate privacy policy any more; it redirects into ActiveCampaign's. Reviewing the AC master DPA and assuming it covers Postmark gets both the incorporation mechanism and the sub-processor list wrong.

**Mailchimp (Intuit)** — The Rocket Science Group LLC. **Intuit Ireland Software Limited is only the Art 27 representative**, not a contracting entity. Processor by default, but the DPA "shall not apply to instances where Mailchimp is the controller of Customer Data unless otherwise described in Annex C" — and those controller purposes are not enumerated. Data may go "to the United States and anywhere else in the world"; no EU region. 2021 SCCs C2P and P2P; **UK Addendum version B1.0**; DPF asserted. DPA (26.09.2024) auto-incorporated. Sub-processors `mailchimp.com/legal/subprocessors/` — **last updated 29.02.2024, stale against the DPA**; 24 entities including OpenAI; **10 days' notice, 5 calendar days to object, Europe only**. **Open tracking is on by default** ("enabled by default except on plain-text emails"). *Gotcha:* three separate reasons a quick check understates this — no standalone privacy policy, an Art 27 rep mistaken for an EU controller, and tracking on by default.

## Chat and CRM

**Intercom** — the privacy policy names a rotating set of entities "**or any other Intercom group company from time to time**"; which one signs your Master Agreement is `[[MISSING: confirm on the order form]]`. **Split role**: processor for Customer Personal Data, "**Intercom is an independent controller**" for Account Data. "By default, all Customer Data is permanently stored in the USA." EU regional hosting is **plan-gated to Advanced and Expert**, **partial** — billing, workspace admin data and usage metadata still process in the US — and **not migratable**: "direct migration of your existing workspace data from one region to another is not possible", it requires a new workspace. DPF primary, SCCs and IDTA as fallback. DPA (09.04.2025) auto-incorporated. Sub-processors `intercom.com/legal/subprocessors-list` (25.06.2026; `/subprocessors` 404s), including OpenAI, Anthropic and ElevenLabs; **20 days' notice, 20 days to object**. Deletion within 30 days of request, or automatically 180 days after termination. **Device:** Intercom's cookie policy covers `intercom.com` only and does **not enumerate the embedded Messenger's cookies** — a disclosure gap, so capture it yourself. *Gotcha:* "we bought EU hosting" is materially untrue for billing, admin and usage metadata, and an existing workspace cannot be moved into a region.

**Crisp** — **Crisp IM SAS**, Nantes, France, SIREN 833085806. Direct EU contracting party under French law, no US entity. Processor for customer data. **Genuine EU default, not an add-on**: messaging servers in the Netherlands, plugin servers in Germany, no plan gating. Chatbox cookies: exactly two, `crisp-client-session-*` and `crisp-client-*`, both **6 months**, "not used for tracking purposes… they bind a user to server-side session storage used for messaging". Retention: accounts deleted on request or after 12 months of inactivity; contracts up to 10 years; metadata and logs max 1 year; marketing 3 years. Sub-processors `crisp.chat/en/sub-processors/` (15.07.2026), including OpenAI, Gemini, Anthropic and Mistral — **no numeric notice or objection period stated**. **The DPA sits inside the General Terms and is downloadable only from inside a paying account.** *Gotcha:* the best entity and data-location position in this file and the worst documentary one — SCC modules, notice days and objection rights **cannot be verified without an account**, so a documentary review cannot be completed from public sources.

**HubSpot** — country-specific EU entities are the real counterparties, including **HubSpot Germany GmbH for DACH**. **Split role, and the sharpest one here**: processor for the subscription service, **controller for "enrichment products" and the "HubSpot Tracking Code"**. Modules Two and Three for processor data, **Module One for controller data**; UK Addendum; DPF asserted. **No EU residency option found.** DPA `legal.hubspot.com/dpa` (14.04.2026) auto-incorporated. Sub-processors `legal.hubspot.com/sub-processors-page` (`/sub-processors` 404s), including Meta Platforms and OpenAI; **30 days' notice, 30 days to object**; **the only real self-service subscription in this file**: `legal.hubspot.com/subscribe-subprocessor-updates`. Cookies with lifetimes: `__hstc` (6 mo), `hubspotutk` (6 mo, visitor GUID), `__hssc` (30 min), `__hssrc` (session), `messagesUtk` (6 mo). *Gotcha:* **signing the HubSpot DPA does not cover the tracking code.** `hubspotutk`/`__hstc` analytics is HubSpot acting as its own controller — separate legal basis, separate notice paragraph.

## Session replay

**Hotjar (Contentsquare)** — **"Hotjar Ltd (Malta)" is gone from the current legal record.** Contracting resolves via `contentsquare.com/legal/entity-schedule/` to Content Square, Inc. (Americas) or **Content Square SAS, Paris**; the DE/AT country row and the Hotjar-specific row are not aligned, so **get the signing entity in writing**. The Hotjar privacy policy (v7.1, 17.01.2024) still names Hotjar Ltd — unreconciled. **Split role**: customer is controller, Contentsquare is processor, "**and (iii) Contentsquare may also process Customer Data as a Controller**" (uses not detailed). Storage default **eu-west-1, Ireland**; no separate residency toggle. SCC Modules Two and Three, UK IDTA, DPF asserted; **EU SCCs governed by French law, French courts**. DPA `contentsquare.com/privacy-center/data-processing-agreement/` (v2026.2) **auto-incorporated** — "Execution of this MSA and/or any Order Form shall be deemed as execution of the DPA and the Standard Contractual Clauses". Sub-processors `contentsquare.com/privacy-center/subprocessors/` (v2026.4), including **Azure/OpenAI for LLM services**; **30 calendar days to object**, silence is acceptance; the advance-notice period in days is not separately specified. Cookies `_hjSession_*`, `_hjSessionUser_*`, `_hjTLDTest` and others — **the cookie page lists no lifetimes**. **IP is not anonymised at collection**: "We automatically delete these IP addresses within thirty (30) calendar days." DNT **is** honoured; consent is pushed to you — "It is the responsibility of the website owner to obtain consent" — and there is no default CMP self-gating. Retention: recordings and heatmaps **365 days**, survey responses indefinite. *Gotcha:* any Impressum, DPA or ROPA entry built on "Hotjar Ltd, Malta" is stale paperwork against a dead contracting path, and both the old DPA and sub-processor URLs are gone.

**Microsoft Clarity — read this one carefully; it is not a processor.** Governed by the standalone Clarity Terms of Use, **not** the Microsoft Products and Services DPA — an existing Azure or M365 enterprise DPA almost certainly does not cover it. Terms, verbatim: "You and Microsoft are **independent Controllers**… The parties agree that **neither of them are a 'processor,' 'service provider,' or equivalent status**." FAQ: "Clarity is GDPR-compliant as a data controller." **Microsoft's own-purpose rights, verbatim:** "Microsoft may use the Personal Data it collects… **for any purpose**… including to provide the Offering; improve Microsoft's products and services…; and **create user profiles for purposes that include advertising**", plus non-personal data "leveraged… for training, fine-tuning, and evaluating machine learning models". Microsoft's own suggested site disclosure names **Microsoft Advertising** downstream. EU customers contract with **Microsoft Ireland Operations Limited**, which holds SCCs with Microsoft Corporation. Data is "stored in the Microsoft Azure cloud service" — **no region named, none selectable**. **No DPA exists and structurally cannot**; no sub-processor list, no notice period, no objection window. Payloads: analytics (clicks, scroll, mouse, resize, selection, **input**, performance), **playback = full DOM capture**, envelope IDs. Masking modes Strict / **Balanced (default)** / Relaxed; "**Content in the input boxes is masked in all modes and can't be customized**". Cookies `_clck`, `_clsk` first-party plus third-party **CLID, ANONCHK, MR, MUID, SM** — the Microsoft advertising family. **Consent Mode is on by default only for the EEA, UK and Switzerland, enforced from 31.10.2025** — and a refusal does not stop it: with `analytics_storage: denied`, "**Clarity tag loads, but only cookieless data is collected.**" **DNT is explicitly not honoured**; GPC is. Retention: playback 30 days, click and heatmap data 9 months, favourited sessions 9 months — **not configurable** — and per-subject deletion is impossible: "You need to delete the entire project to delete user's data." Microsoft states Clarity "shouldn't be used on any websites/apps targeting users under the age of 18." *Gotcha:* asking where Clarity's DPA is, is a category error. It is a controller with contractual advertising-profile and ML rights, no Art 17 path for a single visitor, and no paid tier with better terms — "free forever" is the whole product.

## Google integrations

Google splits its products explicitly (`business.safety.google/gdpr/`): **processor** for Ads Data Hub, Customer Match, Google Marketing Platform, GCP and Workspace; **independent controller** for AdMob, AdSense, Google Ads, Ad Manager and **Google Maps APIs**. Cloud sub-processor list (16.07.2026): 30 days' notice, 90 days to object but **the only remedy is terminating the agreement**, notification to a self-designated address — no subscription, no RSS.

**YouTube embeds / youtube-nocookie.com** — the EEA and Swiss provider is **Google Ireland Limited** (ToS 29.11.2023). Consumer-service regime: neither the Ads Controller Terms nor the Cloud Processor Terms apply, and Google's pages do not state what role it takes toward an embedding site operator. **No DPA exists for an embedding site operator — that is the finding.** Documented cookies include `VISITOR_INFO1_LIVE` (6 mo, "may enable personalized recommendations… based on past views"), `YSC` (session), `PREF` (8 mo), `__Secure-ROLLOUT_TOKEN` (6 mo), `__Secure-YNID` (6 mo), `__Secure-YENID` (13 mo). **What nocookie mode actually says**: views "will not be used to personalize the YouTube browsing experience", ads "will likewise be non-personalized", and it "will not be used to personalize advertising shown to the viewer outside of your site or app"; and expressly, if the viewer clicks out of the embed, "that website or app may track the viewer's behavior as per that website's or app's policies." *Gotcha:* **privacy-enhanced mode is a personalisation opt-out, not a data-collection opt-out.** Google nowhere claims zero cookies. Use a click-to-load wrapper.

**Google Fonts** — role **unstated**: Fonts appears in none of the three regimes and is not in Appendix 4 of the Cloud DPA. **No DPA exists for the Fonts API.** The FAQ states the API collects "**the IP address used by the respective user to access the Internet**", the requested URL, and "**HTTP headers including the user agent… as well as the referer**", without distinguishing the `fonts.googleapis.com` CSS request from the `fonts.gstatic.com` file request. Counter-statement: Google "does not use any information collected by Google Fonts to create profiles of end users or for targeted advertising" — a policy statement, not a contractual term, and unenforceable through any Google DPA. **No retention period is stated.** Self-hosting is endorsed by Google itself: "**When a font is loaded from the website operator's servers, Google does not receive any kind of data related to the visits to the website.**" *Gotcha:* IP plus full headers logged on every request, no retention commitment, and no contract to attach one to. Self-host; do not build a consent gate around a font. See `enforcement.md` for the German and Austrian case law, which diverge.

**Google Maps / Maps Embed API** — for Austria and most of the EEA the contracting entity is **Google Cloud EMEA Limited**, not Google Ireland Limited. **Controller, confirmed twice**: the GDPR product split lists Maps APIs as an independent-controller product, and Maps Platform Terms § 4.4(b) states "Google and Customer agree to the **Controller-Controller Data Protection Terms**", with § 4.4(a) reserving Google's use of the data "to provide and improve Google products and services". **No processor DPA exists**, and Maps is **not named** in the Cloud sub-processor list — so no Maps-specific list, notice period or objection window exists either. The Embed API documentation contains **no statement about cookies or pre-interaction collection at all**, and Google's cookie inventory names no Maps cookie. *Gotcha:* "it is a Google Cloud product, so the Cloud DPA makes them a processor" is wrong for Maps. It is controller-to-controller, the same bucket as Ads.

**Google reCAPTCHA v2 / v3 / Enterprise** — `developers.google.com/recaptcha/docs/terms` **404s**. The reCAPTCHA FAQ (02.04.2026, itself marked deprecated) states that **from 02.04.2026** Google moves from independent controller to **processor**: "reCAPTCHA customers are the sole data controller of Customer Data and Google only processes your reCAPTCHA Customer Data in accordance with the Google Cloud Terms of Service and Cloud Data Processing Addendum." **But reCAPTCHA is not named in Appendix 4 of that Cloud DPA**, which lists only GCP, Workspace and Cloud Identity, Looker, SecOps, Implementation Services and Google Skills — and the Cloud sub-processor list does not mention reCAPTCHA at all. Processing location, retention and sub-processors are unstated. One documented cookie: "reCAPTCHA sets a necessary cookie (**`_GRECAPTCHA`**) when executed for the purpose of providing its risk analysis"; `www.recaptcha.net` is offered as an alternative host. **Google instructs developers to fire it early**: "For optimal performance, it's generally recommended to load reCAPTCHA early in the page lifecycle" and "Waiting to load reCAPTCHA until a specific restricted action occurs (for example, form submission) is **generally not recommended**." *Gotcha:* the least documented Google product here — a role asserted on a deprecated FAQ page but unsupported by the DPA appendix it points to, no location, no retention, no sub-processor list, a 404 on its own terms page, and vendor guidance to load it before any user action. Escalate the documentary absence; scope it to the form that needs it.

## Embeds, forms and scheduling

**Vimeo** — **`vimeo.com/gdpr` and `vimeo.com/dpa` are not legal pages**; they resolve to unrelated user vanity profiles. The real documents live under `vimeo.com/legal/`. Vimeo.com, Inc., New York; **no EU contracting entity**, only an Art 27 representative (EDPO, Brussels). **Split role** with explicit module mapping (Enterprise DPA, 24.04.2026): Module Two where the company is controller, Module Three where it is processor, "**Module One where Vimeo and Company are each a controller**"; UK IDTA; a Swiss clause naming the FDPIC. **Gap:** neither the DPA nor the privacy policy assigns a role for **anonymous viewers of an embedded player on a third-party site**. Auto-incorporated for Enterprise; the acceptance mechanism on Free and Pro is unstated. Sub-processors (29.04.2026): **no numeric notice period**, and the objection right is effectively absent — "If Company objects to any sub-processing by Vimeo, Company **should immediately discontinue its use of the Enterprise Services**." Player cookies: `vuid` (2 yr), `player` (1 yr), `flags` (1 yr), plus security cookies `player_clearance` (7 days), `cf_clearance` (1 yr), `__cf_bm` (30 min), `_cfuvid` (session). **`dnt=1`** "prevents [Vimeo] from setting any new cookies on your browser during that viewing session" but does not "prevent your browser from sending cookies that were already stored" — **and the four Cloudflare cookies are still set with `dnt=1` enabled**. *Gotcha:* `dnt=1` is not a cookie-free mode.

**hCaptcha** — Intuition Machines, Inc., Delaware; no EU entity. **The role inverts the expectation**: the Terms (17.11.2025) say "We operate as a '**data processor**'… we process personal information **on behalf of our Integrators**", controller only for the integrator's account data. Location is mixed: the GDPR page says "By default, analytics data is already stored in the EU" while the general privacy policy (07.10.2025) says data "may be stored and processed in any country where we have facilities" — **not a hard regional guarantee**. SCCs "integrated within the Data Processing Addendum"; DPF, UK Extension and Swiss-US asserted; **the DPA is a PDF dated 20.04.2023**, so modules and clauses are unreadable. `hcaptcha.com/subprocessors` **404s — no sub-processor list found at all**. Device: cookies `hmt_id`, `INGRESSCOOKIE`, `__cfduid`, `hc_accessibility`, `__cf_bm`, plus localStorage `hcap_uj_e`; collected data includes "**mouse movements, scroll position, keypress events, touch events**" plus IP, browser, ISP, platform and device type. **It runs pre-consent by design** — its own position is that these are "consent-exempt cookies pursuant to GDPR regulations". Retention: technical cookies up to a year past expiry; **support records "may be kept indefinitely"**. *Gotcha:* "**Zero PII**" and first-party hosting are **paid Enterprise features**. Citing hCaptcha's privacy marketing to justify a default free install cites the wrong tier — and there is no readable sub-processor list.

**Typeform** — **TYPEFORM, S.L.**, Barcelona: a genuine EU contracting entity. Typeform US LLC is **joint controller with Typeform S.L. for the sales relationship only**; Typeform S.L. is sole controller for service provision. Processor throughout for respondent data, with **no independent-controller carve-out for embedded-form visitors** — unlike Vimeo and Calendly. The public privacy policy cites only generic "SCCs"; the DPA (17.07.2026) is far more specific: **Module 2** for controller-to-processor, **Module 3** for sub-processor transfers, Module 4 referenced, **UK IDTA as Annex III**. **Swiss: no mechanism stated in either document.** Whether the DPA binds automatically for non-Enterprise customers is unstated. Sub-processors: the DPA-cited help article is authoritative (the privacy policy cites a different, renumbered one); **15 calendar days to object**, with a separate 15-day termination clause — do not conflate them. The cookie policy (01.05.2023) lists categories only and **does not say what an embedded form sets or when** — a gap in Typeform's own disclosure. Account data retained "during the five years following the end of said relationship"; respondent retention unstated. *Gotcha:* the policy and the DPA disagree in specificity, and Swiss transfers have no stated mechanism anywhere. Structurally, a form vendor receives free text, so Art 9 data is always possible.

**Calendly** — Calendly, LLC, Georgia. **No EU entity named, and no Art 27 representative found.** **Split role, and the sharpest widget finding here**: processor for invitee booking data, but **DPA Exhibit D, "Controller to Controller Terms Applicable to the Embedded Services": "Customer and Calendly are separate and independent controllers of the Cookie Data"**, with the mechanism switching — "all references to 'Module 2 of the SCCs' shall be replaced with 'Module 1 of the SCCs'." Processing "in the United States or in other countries"; **no Calendly-offered EU residency**. DPF, SCCs, UK Addendum. DPA `calendly.com/legal/data-processing-addendum` (01.06.2026) auto-incorporated — "Customer is deemed to have signed this Annex I by accepting Calendly's Customer Terms". Sub-processors (10.07.2026), 22 entities including Notetaker audio and video processing; **30 days' notice, 30 days to object** — but customers who do not subscribe to the notification list "**waive any right**" to prior notice. `calendly.com/legal/cookie-notice` **404s**, so the widget's pre-interaction cookies are `[[MISSING: capture them yourself]]`. *Gotcha:* two compounding problems — the independent-controller re-designation for widget cookie data is buried in Exhibit D, not the DPA body; and the objection right is opt-in only and silently waived by never subscribing.

## Workplace

**Slack (Salesforce)** — EEA users contract with **Slack Technologies Limited, Dublin**, under **English law, London venue**. **Split role**: processor for Customer Data, "**Slack is the controller of Other Information**" (account, device, usage). **Data residency is Business+ and Enterprise only** and covers messages, canvases, snippets, files, the search index and app content — **excluding member profiles, workspace and channel membership, analytics data and Slack-generated IDs**. Verbatim: "**The data residency feature does not change any aspects of Slack other than the data storage location.**" EU regions Frankfurt, Paris, Stockholm, Zurich. SCCs via the DPA; DPF asserted through Salesforce; **modules not named in readable HTML**. The DPA and the sub-processor list are **PDF-gated**, so notice periods and objection windows are `[[MISSING: request from the vendor]]`. Retention on paid plans is "the lifetime of your workspace by default", owner-configurable — but "**If you delete a channel, messages and revisions will be permanently deleted, regardless of your workspace retention settings.**" **AI:** Customer Data "is **never used to train any LLMs**", while the Supplemental Terms (27.02.2026) simultaneously reserve rights to process Customer Data "to train models for use by the services and features that Customer has access to". *Gotcha:* the no-training assurance is scoped to **LLMs**; non-LLM ML training on customer data is expressly reserved. And EU residency is storage-only.

**Notion** — **Notion Labs, Inc. only.** The MSA (02.04.2026, effective for new customers 01.05.2026) is **California law, San Francisco venue**, with no EU entity anywhere. **Split role**: processor for workspace content, controller for account, usage and telemetry data. **Data residency is Enterprise, sales-assisted accounts only** — narrower than Slack. EU region Frankfurt. Covered: page content, uploaded files, search index, third-party and bot content. **Excluded: account information, usage data, data processed by sub-processors, Notion Calendar and Mail, and Beta Services.** Verbatim: "**The data residency feature only changes the data at rest storage location.**" DPA: "**Module Two will apply**… otherwise **Module Three**"; UK IDTA; Swiss modifications. Auto-incorporated but **dated 22.02.2023 — three years older than the MSA**; flag the staleness. Sub-processors (01.06.2026): **10 days' notice, 10 days to object**, resolution "not exceed thirty (30) days"; subscription is a **manual e-mail** to `team@makenotion.com` with the subject "Subscribe to New Subprocessors". The list names **Anthropic, OpenAI, X.AI, Cerebras, Fireworks, Baseten, Exa and Mathpix**. `notion.com/cookies` is auth-walled, so cookie behaviour is `[[MISSING: capture it yourself]]`. Retention: no numeric trash, version-history or deleted-workspace purge windows anywhere. **AI:** "**By default, Notion and its AI Subprocessors do not use Customer Data to train any models**", backed by contractual prohibitions on the AI sub-processors — stated as a default, not an opt-out. *Gotcha:* every EU customer, including those paying for EU residency, contracts with a California corporation under California law; and because residency explicitly excludes "data processed by subprocessors", which now includes several US frontier-model vendors, "EU residency plus no AI training" does not mean content stays in the EU.

## Patterns worth carrying forward

1. **Not processors** — these need a controller-to-controller or joint basis, not an Art 28 DPA: **Microsoft Clarity** (explicitly rejects processor status and reserves advertising-profile and ML rights), **Google Maps APIs**, **Calendly for widget cookie data** (Exhibit D, Module One), **Vimeo for its own account data**. Split independent-controller carve-outs at Resend, Intercom, HubSpot (tracking code), Slack (Other Information) and Contentsquare.
2. **No DPA exists at all** for: YouTube embeds as a site operator, the Google Fonts API, Google Maps in processor form, and free reCAPTCHA. The fix for these is architectural — click-to-load, self-hosting — not contractual.
3. **"EU residency" that is storage-only**: Slack ("does not change any aspects of Slack other than the data storage location"), Notion ("only changes the data at rest storage location"), Intercom (plan-gated, partial, non-migratable). Only **Crisp** offers EU-default processing with an EU contracting entity; Contentsquare is EU-default storage with a French entity.
4. **Objection windows**: Mailchimp 5 days (Europe only), Postmark 7, Notion 10, Resend 14, Typeform 15, Intercom 20, HubSpot / Calendly / Contentsquare 30. Calendly's is **waived entirely** if you never subscribe. Only HubSpot has a real self-service subscription link.
5. **Documents behind a wall**, so the review cannot be completed from public sources: Crisp's DPA (login), hCaptcha's DPA and missing sub-processor list (PDF, 404), Slack's DPA and sub-processor list (PDF), Notion's cookie page (auth), Calendly's cookie notice (404). Request them; do not assume their contents.
6. **Stale paperwork risk**: Hotjar Ltd (Malta) no longer exists in the legal record; Mailchimp's sub-processor list predates its own DPA; Notion's DPA predates its MSA by three years; Resend's cookie policy predates its own tracking feature.
7. **E-mail open tracking**: off by default at Resend, on by default at Mailchimp, unstated at Postmark. Under the CNIL pixel recommendation that default is a consent question, not a setting.

## Checkpoints

- [ ] Entry re-verified against the live page and re-dated
- [ ] Contracting entity confirmed on **your** order form, especially after an acquisition (Hotjar → Contentsquare, Postmark → ActiveCampaign, Slack → Salesforce)
- [ ] Which DPA version binds your account confirmed where a vendor runs more than one
- [ ] Split-role carve-outs given their own legal basis and their own notice sentence
- [ ] Controller-side vendors written into the notice as separate controllers, never as processors
- [ ] DPF assertions checked on the official list for the exact entity
- [ ] Sub-processor notice subscribed with a named owner — and, for Calendly, subscribed at all
- [ ] Art 17 per-subject deletion path confirmed to exist before approval
- [ ] E-mail open- and click-tracking defaults checked and gated
- [ ] All embeds behind click-to-load; captcha scoped to the form that needs it
- [ ] Wall-gated documents requested from the vendor rather than assumed
- [ ] Every `[[MISSING: …]]` above carried into the assessment