Subprocessors and Measurement Providers

Supabase · handles client data

Primary database, authentication, and file storage (lab files, progress photos), including private companion preferences, document metadata and text, source provenance and plan activation history.

• Data it can see: Business phone messages, calls and usage billing; Public reference research for the client companion; Private client workspace and optional AI; Optional WordPress hosting and Shopify catalog connections; Connected mailbox correspondence; Account and profile information; Client wellness and health-related records; Lab files and extracted markers; Historical chart tables and saved charts; Progress photos and movement video; Connected device and wearable metrics; Messages and conversation content; Voice input, call recordings, transcripts, and synthetic voice; Prospect, lead, and CRM contact information; LaunchSite OS business contacts and activity; Campaign and engagement records; AI prompts, outputs, and workspace memory; Usage, device, and diagnostic data; Public AI demo requests; Network membership, learning paths and imports
• Processing region: United States
• When it is in the path: Always active
• Data-protection terms: https://supabase.com/legal/dpa

Stores the bulk of client data. Encrypted in transit and at rest; access scoped by row-level security. Network records include coach-owned shelf folder names, descriptions and listing placement, verified invitation onboarding and retained historical signup requests, pending invitation email addresses and hashed tokens, course and cohort organization, membership history and anonymous daily request totals. Import confirmation receipts contain status and references, not source content.

Microsoft Azure (Container Apps, App Service, MySQL, Blob Storage, Key Vault, Application Insights, Log Analytics) · handles client data

Application and optional isolated WordPress hosting, databases and backups, large-file and managed-app secret storage, private client document originals and course-derived audio, performance monitoring, and error logging.

• Data it can see: Business phone messages, calls and usage billing; Public reference research for the client companion; Private client workspace and optional AI; Optional WordPress hosting and Shopify catalog connections; Coach-controlled hosted WordPress content; Connected mailbox correspondence; Account and profile information; Client wellness and health-related records; Lab files and extracted markers; Historical chart tables and saved charts; Progress photos and movement video; Messages and conversation content; Voice input, call recordings, transcripts, and synthetic voice; Prospect, lead, and CRM contact information; LaunchSite OS business contacts and activity; AI prompts, outputs, and workspace memory; Usage, device, and diagnostic data; Public AI demo requests; Business identity for a white-label app listing; Network membership, learning paths and imports
• Processing region: United States
• When it is in the path: Always active
• Data-protection terms: Microsoft Products and Services Data Protection Addendum (DPA).

Application Insights receives timing and diagnostic traces only - never prompt, reply, or document text. The Log Analytics workspace additionally holds 30 days of request failure records, which include the requesting IP address and user-agent, but no request or response bodies. Key Vault holds provider credentials for managed coach apps; the application database stores only opaque vault references. The application processes shelf folder names, descriptions and listing placement for authorized browsing. Network import files are read transiently by document parsers in the application host. Confirmed extracted course text is stored privately in Blob Storage, and Network database records follow the existing backup path. This parsing does not send invitation CSVs or course source files to an AI provider.

Sentry

Application error monitoring and read-only production issue detection for the private support workflow.

• Data it can see: Usage, device, and diagnostic data
• Processing region: United States
• When it is in the path: Always active
• Data-protection terms: https://sentry.io/legal/dpa/

Configured to exclude request bodies, cookies, and personal data from error events. Private compiled application source maps from credential-free builds support readable stack traces; they contain application code, not event payloads. The support monitor reads issue aggregates and latest events, then retains only a restricted diagnostic projection. Code-built briefs exclude raw error text, user identifiers, request bodies, breadcrumbs and stack locals; the sanitized briefs enter the existing private Discord and support classification workflow for administrator review and, when the separate local T3 connector is enabled, can start coding tasks using that bounded brief. Raw webhook bodies are not forwarded to T3. The monitor never changes an issue in Sentry.

Microsoft Azure AI Services (including Azure OpenAI and Foundry Models) · handles client data

AI-assisted drafting, coach-requested bulk client-record sorting and proposed roster matching before import, embeddings, image generation, audio transcription, OCR and document-layout extraction for uploaded lab reports, retrieval-only context generation and relevance reranking for coach documents, private Zyx goal reviews and optional progress-photo observations, answering paid independent and coach-sponsored client questions from authorized knowledge and private documents, personalized client briefs, owner-enabled course audio transcription, turning a coach’s recorded demonstration into a Launch Bot’s written instructions and tool list, the public meal-plan demo on the marketing site, transient screenshot inspection for configured Discord platform-support intake channels, bounded support intake summaries and, only when an operator selects it, labelling platform support evidence by comparison with fictional labelled examples.

• Data it can see: Business phone messages, calls and usage billing; Public reference research for the client companion; Private client workspace and optional AI; Connected mailbox correspondence; Client wellness and health-related records; Lab files and extracted markers; Messages and conversation content; Voice input, call recordings, transcripts, and synthetic voice; Prospect, lead, and CRM contact information; LaunchSite OS business contacts and activity; AI prompts, outputs, and workspace memory; Progress photos and movement video; Public AI demo requests; Pages and optional screen images Co-Work uses; Recorded demonstrations of a coach’s own workflow; Platform support messages and engineering review; Network membership, learning paths and imports
• Processing region: Global processing (Azure resources are located in the United States).
• When it is in the path: Always active
• Data-protection terms: Microsoft Products and Services Data Protection Addendum (DPA).

When selected as the existing AI provider, this service receives bounded, orientation-normalized AI Memories photo copies without image metadata, including up to two overlapping detail crops within the same total byte limit, to extract visible text, tables and factual descriptions. LaunchSite stores originals in Library and indexes derived text under the existing coach, team and client scope. The private client companion can send bounded authorized coach or course passages, client-owned document text, presentation preferences and relevant client records to the configured AI model after consent and allowance checks. Course transcription is separately enabled by the lesson owner, sends bounded extracted audio segments to the configured transcription model and uses the existing coach AI allowance ledger. Stored course-derived audio and transcripts follow the source lifecycle; this differs from personal voice-message audio, which the server does not persist. Public web research sends only fixed topic labels to search and public URLs to the page reader, then can include bounded public evidence in the AI answer. When Azure is the configured Juno provider, requested shelf reads can also send owned folder names, descriptions and listing placement. When Azure is the configured Juno provider, an owner-requested Network growth conversation can send the coach instructions, authorized aggregate report counts, course and cohort labels and dates, member counts, synthetic launch checks, and membership plan terms. These growth tools exclude cohort member identities, invitation email lists and tokens, imported source files and raw Stripe identifiers. Import preview and confirmation use application document parsers, not AI. An explicitly confirmed Juno plan action saves an unpublished draft only; provider retention and existing assistant conversation retention still apply. The optional Discord screenshot reader sends bounded, normalized still-image bytes transiently to the configured Azure vision model. LaunchSite retains derived observations and content-free usage with the report lifecycle, not image bytes, signed links or raw model traces. Derived observations may be shared with the existing support triage providers. Previously generated private-triage split titles follow their existing source retention. The retired planning action no longer sends request-splitting calls. Jev remains the default platform support classifier. When an operator sets the server setting SUPPORT_CLASSIFIER to the example-based classifier, each classification of platform inbox, support chat, bug report or community case evidence (within the existing limit of 200 classifications a day) sends the new support text (at most 12 messages, each cut to 4,000 characters), up to 8 earlier messages cut to 500 characters, any stored screenshot observations and 6 to 10 fictional labelled examples once to the configured Azure chat model. Discord message links are removed and participants are labelled only as requester or staff. LaunchSite keeps the label, confidence, version, model name and token counts with the classification job, never the model's short reason or the raw response. The same setting also labels the scheduled scan of operator-selected community Discord channels: at most 300 scan batches a day, one request per new channel message with text or read screenshots (at most 12 messages a batch, each cut to 4,000 characters, with up to 8 earlier channel messages cut to 500 characters as context), fenced the same way, without Discord identifiers or author names. Jev still decides whether a message belongs to an earlier case, and any failure or a spent daily budget labels the whole batch with Jev. Only the label, confidence and content-free usage (model name, request and token counts, a failure code) are kept for those requests. Any failure falls back to Jev. A coach-requested email reply draft sends only a bounded portion of the selected mailbox thread and coach writing instructions. It does not save or send email, and mailbox content is not used for general model training. The admin lab OCR workbench also sends transient OCR text for marker transcription and marker-derived queries for platform reference retrieval. It displays assembled analysis inputs without generating or saving a review. When the lab OCR lane is enabled, the full uploaded lab PDF is sent to Azure Document Intelligence and Azure returns page text, confidence and layout coordinates; those results are used to create reviewable marker facts, and provider response bodies are not written to application logs. LaunchSite requests deletion of the provider-side analyze result after retrieval; Microsoft documents automatic deletion after 24 hours when early deletion is not confirmed. Microsoft states that prompts and outputs for models sold directly by Azure are not made available to the model provider. Context generation sends a coach document to the same Azure-operated service and stores its output separately from the clean source passage; generated context is used only to retrieve, and is never shown or cited as evidence. Reranking sends the search query and a bounded candidate set to an Azure-hosted model and stores no provider response as source evidence.

Anthropic · handles client data

AI-assisted drafting and analysis, including private Zyx goal reviews and optional progress-photo observations when this provider is selected. Separately enabled Claude Code sessions advise on minimized managed-app fulfillment plans through the independent collector. When selected in the operator-controlled local T3 project, Claude Code can work on bounded platform support tasks and sanitized monitoring findings.

• Data it can see: Business phone messages, calls and usage billing; Usage, device, and diagnostic data; Public reference research for the client companion; Private client workspace and optional AI; Client wellness and health-related records; Lab files and extracted markers; Messages and conversation content; Prospect, lead, and CRM contact information; LaunchSite OS business contacts and activity; AI prompts, outputs, and workspace memory; Progress photos and movement video; Managed app fulfillment status and operator planning; Platform support messages and engineering review
• Processing region: United States
• When it is in the path: Always active
• Data-protection terms: https://www.anthropic.com/legal/commercial-terms

Application requests use the configured Anthropic endpoint, including Azure-hosted Foundry when configured; the SDK can use the commercial Anthropic API when no custom endpoint is set. The independent managed-app fulfillment integration can send minimized fulfillment facts to a separately configured Claude Code account. No provider credentials or raw managed-app intake documents are included in that feed. Claude Code account terms, retention, workspace controls and model-training settings must be verified separately; application API configuration does not establish those terms. Fulfillment case history remains until operator cleanup. The separate local T3 connector can send the existing bounded support task brief and canonical case/source links when Claude Code is the configured coding provider. It does not fetch private attachments or transfer raw Sentry webhook bodies; source-derived brief text may still contain personal or health information. T3 is locally operated software. Local thread history, provider sessions and worktrees have separate retention and are not automatically removed by LaunchSite source erasure or case closure. Claude Code subscription or API account terms must be checked independently; this disclosure does not establish an executed agreement or zero retention for those sessions. The retired platform support worker no longer starts advisor or review sessions. Previously submitted support content remains subject to provider retention and separate deletion procedures. LaunchSite does not use client health information to train models.

Resend

Transactional, campaign and review-request email delivery, coach-domain verification and sending-key provisioning, fixed administrator test messages, and delivery, engagement, bounce and complaint webhooks.

• Data it can see: Account and profile information; Messages and conversation content; Campaign and engagement records; Prospect, lead, and CRM contact information; LaunchSite OS business contacts and activity
• Processing region: United States
• When it is in the path: Always active
• Data-protection terms: https://resend.com/legal/dpa

Managed coach apps use separate verified domains and domain-scoped sending keys within the LaunchSite Resend account. The one-time key value is transferred directly to Azure Key Vault. A platform administrator may send a fixed provisioning test to a chosen recipient; Resend receives that address and message.

Amazon Web Services (Simple Email Service)

Alternate transactional, campaign and review-request email delivery path.

• Data it can see: Account and profile information; Messages and conversation content; Campaign and engagement records
• Processing region: United States
• When it is in the path: Always active
• Data-protection terms: https://aws.amazon.com/service-terms/

Apple and Google (sign-in)

Verifying who you are when you sign in with "Continue with Apple" or "Continue with Google" instead of a password.

• Data it can see: Account and profile information
• Processing region: United States
• When it is in the path: Always active
• Data-protection terms: https://developer.apple.com/support/terms/apple-developer-program-license-agreement/

Offered on the web login page and in the mobile app, and only in the path for a user who chooses one of those buttons - a password sign-in involves neither. The provider tells us the email address and a stable identifier for the account (Google also shares the account’s name and profile picture), and learns that you signed in to LaunchSite OS; it receives no health, message, or coaching data. Apple users may substitute a private relay address, which works exactly like any other address here. In the mobile app, signing in this way only opens a coach or client account that already exists for that email address; anything else is signed back out. On the web, a Google sign-in that matches no account can continue to coach signup, and the account is created only if the person completes it. Our authentication provider keeps the sign-in identity it records, including for a sign-in that leads to no account, until deletion is requested.

Stripe

Subscription billing, including the separate Pro CRM add-on and CRM website-domain subscriptions, payment processing (including managed mobile app setup and maintenance), template and reusable-course marketplace payouts to coaches (Stripe Connect), one-time CRM and Networks website payments and course-access bundles on coach connected accounts, and payment for consultations booked on a coach’s public booking page. Business phone rental and prepaid usage credit use billing references, amounts and billing addresses for automatic tax, not SMS content or call audio.

• Data it can see: Account and profile information; Subscription and payment information; Prospect, lead, and CRM contact information; LaunchSite OS business contacts and activity
• Processing region: United States
• When it is in the path: Always active
• Data-protection terms: https://stripe.com/legal/dpa

Processes billing data (name, email, card) only - no client health data. Coaches who sell through the marketplace complete Stripe Connect onboarding directly with Stripe, which collects the identity and bank details required by financial regulation. When a coach charges for a call on their public booking page, the charge is taken DIRECTLY on that coach’s own connected account with no platform fee - the coach is the merchant of record and the funds never enter a LaunchSite balance. Card details are entered on Stripe’s own hosted checkout and are never seen or stored by LaunchSite; we keep only the amount, the currency, whether it was paid, and Stripe’s session identifiers. Shared website offers also charge directly on the selling coach connected account with no platform fee in this flow. Stripe receives the offer name, amount, currency and opaque order identifier; lesson content and learner assessment data are not included. Verified payment and full-refund events update purchase access. These one-time offers are separate from recurring subscriptions and the coach Marketplace fee. For managed coach apps, a permanent purchase-specific payment link opens Stripe Checkout. Expired checkout sessions can be renewed using the same approved purchase, saved prices, and Stripe Customer; the shared payment link has no scheduled expiry. CRM website-domain purchases use a separate recurring Stripe subscription; LaunchSite keeps the selected domain and provisioning state, while Stripe receives billing details.

n8n

Internal workflow automation for our own outbound marketing operations.

• Data it can see: Prospect, lead, and CRM contact information; LaunchSite OS business contacts and activity
• Processing region: United States
• When it is in the path: Always active
• Data-protection terms: Available on request.

Used by LaunchSite OS for our own prospect outreach. It is not part of a coach’s workspace and sees no client data.

GitHub (Microsoft) · handles client data

Source control, automated provisioning of coach site repositories, CI runners that build, test, and deploy the application, private storage of retrieval evaluation reports, ordinary repository changes from operator-enabled local T3 support tasks, and retained pull requests from the retired support worker.

• Data it can see: Optional WordPress hosting and Shopify catalog connections; Account and profile information; Client wellness and health-related records; Lab files and extracted markers; Progress photos and movement video; Connected device and wearable metrics; Messages and conversation content; Voice input, call recordings, transcripts, and synthetic voice; Prospect, lead, and CRM contact information; LaunchSite OS business contacts and activity; Campaign and engagement records; AI prompts, outputs, and workspace memory; Usage, device, and diagnostic data; Public AI demo requests; Business identity for a white-label app listing; Platform support messages and engineering review; Network membership, learning paths and imports
• Processing region: United States
• When it is in the path: Always active
• Data-protection terms: https://github.com/customer-terms/github-data-protection-agreement

Engineering infrastructure. The nightly production database backup is produced on a GitHub-hosted runner, so the database contents transit that runner before being written to Azure Blob and shredded; file contents in Supabase Storage (lab documents, progress photos) are not part of that dump, only the rows describing them. GitHub does not appear on Microsoft's published HIPAA BAA in-scope service list, and GitHub's Data Protection Agreement s12.B asks that protected health information not be provided without GitHub's prior written consent. Support monitoring reads workflow outcomes and runtime dependency advisories. Trusted workflows sign database-advisor and test summaries with GitHub OIDC. The coordinator retains advisor lint codes, levels, categories, schema object names and Supabase remediation links, and otherwise only opaque references, fixed codes, counts and receipt hashes; raw advisor descriptions and test failures are excluded. Retrieval evaluation runs on the same private runner/artifact boundary. Its report contains aggregate rank metrics, committed golden questions, bounded expected-answer excerpts for misses, source names, and corpus counts; it does not copy retrieved candidate passages or user-authored search queries. Optional WordPress provisioning decrypts the bootstrap administrator and database credentials into a restricted temporary runner file, provisions Azure, and removes the file at job completion. No website backups are imported through this runner. Managed-app provisioning also runs on a GitHub-hosted runner: validated coach artwork and public app configuration are committed to a generated source pull request, while the Apple private key is retrieved from Key Vault into a temporary runner file and deleted at the end of the job.

Shopify

Coach-authorized store identity and product catalog access; Shopify continues to operate the store and checkout.

• Data it can see: Optional WordPress hosting and Shopify catalog connections
• Processing region: Processing locations governed by the merchant’s Shopify agreement.
• When it is in the path: Only if a coach connects it
• Data-protection terms: https://www.shopify.com/legal/dpa

The connection requests read_products only. LaunchSite does not retrieve customers or orders, process Shopify payments, or send coaching or health records to Shopify. Referencing the published addendum does not establish an executed account-specific agreement.

Firecrawl (SideGuide Technologies, Inc.)

Read public reference articles for requested Scientist research and paid client companion answers after general-library retrieval.

• Data it can see: Public research for coaching briefs; Public reference research for the client companion
• Processing region: United States (per published privacy policy)
• When it is in the path: Only for a coach or client who uses the optional feature
• Data-protection terms: Published privacy terms: https://www.firecrawl.dev/privacy-policy. A DPA and account-specific execution have not been verified; request and review them with the vendor.

Receives public research article URLs selected by Scientist or the client companion and fetches their public content. Companion research uses fixed public topic labels and reads at most three pages from an enumerated reliable-host list; freeform client questions, names, lab values and private records are not sent to search or this page reader. Lead Scout does not use this provider. The integration sends no coach account identifiers, private workspace records, cookies or target-site credentials. Scrape caching is disabled, which does not establish zero retention for provider logs. Provider retention and deletion require separate review.

Fullscript · handles client data

Optional coach-selected storefront, authorized practice connection and official practitioner editor. Fullscript handles its own onboarding, supported plan authoring, payment and fulfillment. LaunchSite sends the authorized practitioner credential and verified matched patient identifier, synchronizes released directions, patient-facing messages and resource references, and may read permitted order and eligible lab recommendation/status data. Coaches can author through the official embedded Fullscript interface when the provider enables it. Clients can read supported assignments in LaunchSite; checkout remains in Fullscript. An explicitly confirmed patient-creation request sends only reviewed first name, last name and email, suppresses the provider welcome email and returns a candidate for separate matching.

• Data it can see: Account and profile information; Client wellness and health-related records; Subscription and payment information; Usage, device, and diagnostic data; Optional Fullscript plans, resources and practice connection
• Processing region: External service; processing locations are described in Fullscript’s privacy statement.
• When it is in the path: Only if a coach connects it
• Role: Independent controller under its published terms.
• Data-protection terms: https://fullscript.com/legal/privacy

Independent-controller classification describes Fullscript’s own practitioner, patient and commerce service; account-specific API roles and contractual obligations still require review before real-data production use. No executed DPA, BAA, clinical-use approval or production commercial approval has been verified. Sandbox testing uses synthetic records and does not change LaunchSite’s wellness-only policy. Tokens are encrypted server-side; embedded session grants expire quickly. The integration never publishes OAuth credentials, private invitation or checkout links, or stored attachment URLs. Lab result sharing is not implemented. Direct Fullscript projections and marked derived checklists are excluded from general AI plan retrieval and AI edits. Fullscript may independently send notifications and process information under its own terms.

Cloudflare

DNS, domain registration, and custom-domain provisioning for coach sites.

• Data it can see: Account and profile information
• Processing region: Global edge network
• When it is in the path: Only if a coach connects it
• Data-protection terms: https://www.cloudflare.com/cloudflare-customer-dpa/

Receives the registrant details a coach supplies when they register or connect a domain. ICANN requires those details for registration; the domain service sees no client health data. The former support-session tunnel connector has been removed and no longer relays the retained session records. Historical access records and provider retention are subject to the applicable Cloudflare account terms and separate deletion procedures. The linked addendum is the published customer DPA; account-specific execution has not been verified.

OpenAI · handles client data

Hosted AI Atelier website and funnel planning, drafting, visual review, brand extraction, creative project file editing with explicitly selected picture and visual-reference image contents, and optional original image generation guided by selected reference images; Juno network and course drafting from a coach description and explicitly selected file references, including image analysis and optional banner and logo generation; Realtime and GPT-Live voice sessions for the co-work surface, including the Responses model a Live session delegates tool use to; business phone audio and approved public business instructions for separately enabled Realtime Mini agents; and writing a coach’s recorded Loom check-in review into its structured written review through the direct OpenAI API.

• Data it can see: Business phone messages, calls and usage billing; Usage, device, and diagnostic data; Public reference research for the client companion; Private client workspace and optional AI; Voice input, call recordings, transcripts, and synthetic voice; Client wellness and health-related records; AI prompts, outputs, and workspace memory; Progress photos and movement video; Optional AI network setup; Network membership, learning paths and imports
• Processing region: United States
• When it is in the path: Only if a coach connects it
• Data-protection terms: https://openai.com/policies/data-processing-addendum

API terms: inputs and outputs are not used to train models. Optional private client AI may use the direct API when that endpoint is configured; the ordinary configured Azure path is covered under Azure above. The Draft from Loom lane sends the captured Loom transcript and the client context for that check-in to OpenAI; the transcript text is deleted from our storage once the review is approved, and OpenAI does not retain API inputs for training. When Juno uses the direct OpenAI endpoint, requested shelf reads can also send owned folder names, descriptions and listing placement. When Juno uses the direct OpenAI endpoint, an owner-requested Network growth conversation can send coach instructions, authorized aggregate report counts, course and cohort labels and dates, member counts, synthetic launch checks, and membership plan terms. These growth tools exclude cohort member identities, invitation email lists and tokens, imported source files and raw Stripe identifiers. Import preview and confirmation use application document parsers, not AI. An explicitly confirmed Juno plan action saves an unpublished draft only; provider retention and existing assistant conversation retention still apply. This is separate from the optional file-assisted Network builder described above.

Unipile · handles client data

Connected WhatsApp and Instagram conversations and coach-configured conversation workflows in paid Pro CRM.

• Data it can see: Client wellness and health-related records; Messages and conversation content; Prospect, lead, and CRM contact information; LaunchSite OS business contacts and activity
• Processing region: European Union
• When it is in the path: Only if a coach connects it
• Data-protection terms: https://www.unipile.com/dpa/

Active for connected social conversations, which can include health information supplied by correspondents. Email connections now use direct Google and Microsoft authorization and APIs; LaunchSite no longer requests mailbox data or sends email through Unipile. Historical grants in a provider account may require separate removal by the account owner.

Meta Platforms (Instagram messaging) · handles client data

Direct Instagram connection in paid Pro CRM through Meta’s Instagram API with Instagram Login. A coach authorizes their Instagram professional account, Meta delivers the direct messages people send that account, and LaunchSite sends the coach’s replies, media and reactions, and replies from coach-configured workflows and AI lead agents, through Meta.

• Data it can see: Client wellness and health-related records; Messages and conversation content; Prospect, lead, and CRM contact information; LaunchSite OS business contacts and activity
• Processing region: United States / global
• When it is in the path: Only if a coach connects it
• Data-protection terms: https://www.facebook.com/legal/terms/dataprocessing

Separate from Unipile and from the Facebook and Instagram business accounts entry. Offered only where LaunchSite has enabled direct connection; an Instagram account already connected through Unipile keeps working there until the coach reconnects it directly. Conversations can include health information supplied by correspondents. Meta serves only the 20 most recent messages of a conversation, so LaunchSite stores the conversations of a directly connected account, including each correspondent’s Instagram-scoped id, username, name, profile picture address and whether they follow the account, and imports its most recent conversations when it is connected. Media a person sends is fetched from Meta when it is viewed rather than copied; media the coach sends is copied to private storage, and Meta fetches it through a link that expires within 15 minutes. The long-lived access token is encrypted in our database. Disconnecting, or a data deletion request Meta forwards for the account, deletes the stored credential, conversations and messages for that account and the coach’s media copies (a copy that cannot be removed is logged for follow-up). Meta’s deauthorization notice destroys the access token and leaves the conversations until one of those happens. The applicable Meta messaging terms require operator verification before production activation; this entry does not represent an executed agreement.

Meta Platforms (WhatsApp Business Platform)

WhatsApp message delivery and inbound webhooks.

• Data it can see: Messages and conversation content; Prospect, lead, and CRM contact information; LaunchSite OS business contacts and activity
• Processing region: United States / global
• When it is in the path: Only if a coach connects it
• Data-protection terms: https://www.whatsapp.com/legal/business-data-processing-terms

Meta Platforms (Facebook and Instagram business accounts)

Connect authorized business assets, retrieve public Facebook recommendations, ad spend and selected lead-form submissions, publish coach-approved review replies and scheduled Facebook/Instagram content, and return observed engagement.

• Data it can see: Account and profile information; Prospect, lead, and CRM contact information; LaunchSite OS business contacts and activity; Campaign and engagement records
• Processing region: United States / global
• When it is in the path: Only if a coach connects it
• Data-protection terms: https://www.facebook.com/legal/terms/dataprocessing

Separate from connected inbox messaging. OAuth credentials are encrypted in our database; the browser receives account names, identifiers and connection status. Each discovered account starts disabled until the coach selects it. Disconnecting clears stored credentials. The applicable Meta contractual terms require operator verification before production activation; this entry does not represent an executed agreement.

Apple, Google, and Mozilla push services

Delivery of web and mobile push notifications to your own device.

• Data it can see: Usage, device, and diagnostic data
• Processing region: Global
• When it is in the path: Only if a client connects it
• Data-protection terms: Available on request.

A push service receives an opaque device token and the notification payload. Notification copy is written to avoid carrying health details.

Expo · handles client data

Managed mobile project creation, cloud builds, over-the-air updates, App Store connection and submission, and push notification delivery.

• Data it can see: Usage, device, and diagnostic data; Business identity for a white-label app listing
• Processing region: United States
• When it is in the path: Only if a coach connects it
• Data-protection terms: https://expo.dev/terms

For a managed coach app, Expo receives its public app configuration, bundle/package identifiers, generated artwork and the Apple organization credential used for non-interactive build or submission work. Provider secrets are materialized only on the runner and are not committed to source.

Google · handles client data

Two-way Calendar sync for a coach, coach-requested network event creation, updates and cancellation with a Google Meet link (event title and times, without member identities or invitations), including a Calendar invitation sent from the coach’s own calendar to a person who books with them (their name, email, the appointment time, the meeting link, their own booking note and a cancel link), read-only Calendar display for a client who connects their own account, busy-time checks so booking pages offer only open times, Drive file browsing and import of coach-selected files into the coach library (Google Docs, Slides, Sheets and Drawings exported as PDF), import of Google Meet transcripts for meetings LaunchSite scheduled with a Meet link, separately authorized discovery of Google Business Profile locations and Google Ads accounts, retrieval of business reviews, daily advertising performance and selected lead-form submissions, and publication of review replies the coach explicitly submits, plus direct Gmail inbox reading, provider drafts, coach-approved sending, read/star/archive actions and matched CRM synchronization.

• Data it can see: Private client workspace and optional AI; Account and profile information; Client wellness and health-related records; Voice input, call recordings, transcripts, and synthetic voice; Prospect, lead, and CRM contact information; LaunchSite OS business contacts and activity; Campaign and engagement records; Connected mailbox correspondence; Messages and conversation content
• Processing region: United States
• When it is in the path: Only if a coach connects it
• Data-protection terms: https://cloud.google.com/terms/data-processing-addendum

Gmail authorization is separate from Calendar, Drive and Meet. Mailbox grants are encrypted server-side. Draft content stays in Gmail; LaunchSite keeps draft identifiers, content fingerprints and send outcomes. Correspondence reaches AI providers only through the features the Privacy Policy’s Google user data section describes (draft assistance and AI lead agents; CRM Jev insights and background analysis are currently unavailable), and is not used to train generalized models. Applicable consumer or Workspace account terms and restricted-scope verification require operator review; this entry does not assert a signed agreement for every account. Only for users who connect it. A client may connect their own Google Calendar to see their own events in the app; those events are read on demand for display and are not stored. Calendar event reads and writes target the primary calendar. Isolated OAuth reviewer accounts can request owned-calendar scopes before their public rollout; client grants remain read-only. Calendar is a sensitive scope; the Drive scope is restricted, and Drive and Meet are coach-only. Google API Calendar, Drive and Meet data is used only to provide those connected features, never for advertising or model training. Marketing connections use separate consent and encrypted credentials; they do not repurpose Calendar or Drive data. A coach selects which discovered business locations and advertising accounts the workspace may use.

Microsoft Graph (Outlook and Microsoft 365) · handles client data

Owner-authorized mailbox reading, native draft storage, coach-approved sending, read/flag/archive actions and matched CRM synchronization.

• Data it can see: Account and profile information; Messages and conversation content; Prospect, lead, and CRM contact information; Connected mailbox correspondence
• Processing region: United States / global; depends on the connected account
• When it is in the path: Only if a coach connects it
• Data-protection terms: https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA

Users authorize delegated mailbox access through Microsoft. Credentials are encrypted server-side. Mailbox lists and plain-text threads are fetched for display; provider drafts and sent messages remain in the mailbox. Only eligible correspondence matched to one CRM lead is copied into CRM history. The Microsoft DPA applies where the account contract provides it; consumer Microsoft accounts have their own terms. Account-specific contractual coverage and sensitive correspondence terms require operator and counsel review. Disconnect deletes local credentials and stops collection; it does not claim to remove the consent grant from the Microsoft account.

Zoom

Creating meetings for booked sessions, creating and managing coach-requested Network event meetings using their titles and times, and receiving meeting webhooks.

• Data it can see: Account and profile information; Prospect, lead, and CRM contact information; LaunchSite OS business contacts and activity; Messages and conversation content
• Processing region: United States
• When it is in the path: Only if a coach connects it
• Data-protection terms: https://explore.zoom.us/en/gdpr/

Network event meetings send only coach-entered titles and times. The workflow does not send client health records, event descriptions or attendee lists, and does not request recording. A coach-entered title can still contain sensitive information.

Whoop · handles client data

Wearable metric sync, at the client’s direction.

• Data it can see: Connected device and wearable metrics
• Processing region: United States
• When it is in the path: Only if a client connects it
• Data-protection terms: https://developer.whoop.com/

Oura · handles client data

Wearable metric sync, at the client’s direction.

• Data it can see: Connected device and wearable metrics
• Processing region: United States
• When it is in the path: Only if a client connects it
• Data-protection terms: https://cloud.ouraring.com/docs/

Fitbit (Google) · handles client data

Wearable metric sync, at the client’s direction.

• Data it can see: Connected device and wearable metrics
• Processing region: United States
• When it is in the path: Only if a client connects it
• Data-protection terms: https://dev.fitbit.com/legal/platform-terms-of-service/

Ultrahuman · handles client data

Wearable metric sync, at the client’s direction.

• Data it can see: Connected device and wearable metrics
• Processing region: United States
• When it is in the path: Only if a client connects it
• Data-protection terms: Available on request.

Apple (HealthKit) · handles client data

Reading approved Apple Health daily categories, including optional weight, and separately enabled workout summaries in the iOS app. Optional two-way weight sync also writes the latest manually entered weight to the on-device Health store.

• Data it can see: Connected device and wearable metrics
• Processing region: On device; aggregates sent to our United States infrastructure
• When it is in the path: Only if a client connects it
• Role: On-device data source, not a cloud recipient of the summaries imported by this connection.
• Platform documentation: The device platform controls its permissions and source records.

HealthKit is an on-device source. Optional two-way weight sync also writes the latest manual weight into the device Health store after separate enablement and write authorization; device and account settings govern any further synchronization. Apple Health imports the latest valid weight measurement per local day within the last 90 days, stored in pounds as daily summaries. Connect or Sync requests weight read access; automatic collection never requests new permissions. Empty results can mean no source measurement or unavailable read access, which Apple does not distinguish. Apple Health daily sync reconciles only submitted categories and dates: missing values in that snapshot, including an empty successful snapshot, remove matching imported daily values. Unsubmitted categories and dates remain unchanged. The 90-day read window is not a retention limit. Apple’s platform rules prohibit using it for advertising or selling it, and we do neither.

Google (Android Health Connect) · handles client data

Read client-approved daily steps, sleep duration, resting heart rate and heart-rate variability (RMSSD) summaries from Health Connect in the Android app for wellness coaching.

• Data it can see: Connected device and wearable metrics
• Processing region: On device; approved daily summaries sent to our United States infrastructure
• When it is in the path: Only if a client connects it
• Role: On-device data source, not a cloud recipient of the summaries imported by this connection.
• Platform documentation: https://developer.android.com/health-and-fitness/health-connect

Health Connect is an on-device source, not a Google cloud recipient of this sync. After the client confirms the in-app explanation and grants Android read permissions, foreground sync reads at most the latest 30 local calendar dates, including today. LaunchSite receives daily summaries, not raw samples, and requests no background-read or older-history permission. Optional two-way weight sync separately requests weight read/write permissions, reads recent external weights into the Home widget in device memory, and saves the latest manually entered daily or weekly weight to the on-device Health store. Disabling this feature stops transfers but leaves exported records in Health Connect. RMSSD remains separate from Apple Health SDNN. Disconnecting deletes imported Health Connect summaries and keeps a provider block until an explicit reconnect; Android permissions can be removed separately in Health Connect settings. Revoking an individual category removes its retained imported summaries when the app next reconciles permissions. The linked platform documentation is not evidence of an executed data-processing agreement. Data already held by source apps or the device remains under their controls.

Loom

Embedding and drafting around coach-recorded walkthrough videos.

• Data it can see: Account and profile information
• Processing region: United States
• When it is in the path: Only if a coach connects it
• Data-protection terms: Available on request.

Tella · handles client data

Playback of coach-recorded review videos and optional import of their edited transcripts for review drafting and coach-confirmed memory notes.

• Data it can see: Account and profile information; Voice input, call recordings, transcripts, and synthetic voice
• Processing region: International processing under Tella’s published DPA and subprocessor list
• When it is in the path: Only if a coach connects it
• Data-protection terms: https://www.tella.com/legal/data-processing-agreement

The coach records in Tella and controls sharing. We resolve share links using public Tella page metadata without sending credentials, then retrieve transcripts using that coach’s API key. We do not upload recordings or client records to Tella. An embedded player contacts Tella from the viewer’s browser. Keys are held in Azure Key Vault. Disconnecting stops retrieval but does not revoke a key at Tella or delete a recording there.

Apple App Store and Google Play (app updates)

Determine whether the installed mobile app has an available store update and open its exact listing when the client chooses Update now.

• Data it can see: Mobile app update availability
• Processing region: Store-service processing locations governed by Apple and Google account terms.
• When it is in the path: Only when a platform administrator enables this support integration
• Role: Independent controller under its published terms.
• Data-protection terms: Store terms and SDK disclosure: https://developer.android.com/guide/playcore/in-app-updates and https://www.apple.com/legal/internet-services/itunes/

The server sends Apple a public numeric app ID and App Store country; it sends no account token, client identity or coaching records. The Google Play In-App Update library processes device metadata, app version and module/asset information to determine availability and size; Google documents encrypted transfer. Installed native versions and Play eligibility are not uploaded to LaunchSite. These providers operate their stores under their own terms; this entry does not claim a processor agreement or regional restriction.

Discord (platform support) · handles client data

Notify platform support staff about platform inbox messages, support chats and bug reports, present support cases and retained engineering plans for administrator review, receive explicit internal operator commands, and relay an administrator-written /message reply to its linked LaunchSite inbox or support chat. Separately enabled scheduled scans read bounded reports from operator-selected community channels, including posts by members without a LaunchSite account, and copy actionable evidence only to private support threads. Deliver minimized platform trial, invoice, cancellation, refund and dispute alerts to a separate private staff billing channel.

• Data it can see: Platform support messages and engineering review; Subscription and payment information; Usage, device, and diagnostic data
• Processing region: Processing locations governed by Discord terms; no regional restriction configured.
• When it is in the path: Only when a platform administrator enables this support integration
• Role: Independent controller under its published terms.
• Data-protection terms: https://discord.com/privacy

Disabled by default. Support notifications initially contain source type and opaque receipts only. Message content requires a separate operator switch; free-text support may contain health or personal information. Raw attachment bytes and signed links are not copied to private support threads or stored records. When screenshot intake is enabled, supported community screenshots are transiently transferred to Azure AI Services and bounded model-derived observations can be shared with existing support providers. When an operator selects the example-based support classifier, a community case's message text and observations are also classified through Azure AI Services without the Discord message link, and so are new messages found by the community channel scan. Support intake and monitoring alerts to a private administrator channel carry only fixed text, check and failure codes, counts, times, a short work item reference and a link to its private card, never support text, titles or credentials. An optional private decisions channel holds one card per decision waiting on an administrator (request title, one plan or task sentence, acceptance results, change size and links), deleted once decided. Discord carries no support actions: buttons, forms and commands are refused without reading or changing anything. Billing alerts have a separate enable switch and carry only opaque account/purchase and processor references, known product labels, amounts/currency and status/times. They exclude names, emails, card data, raw decline text, customer metadata and health content. Their local receipts become eligible for deletion after 90 days on the next active queue claim; disabled or misconfigured delivery does not run cleanup. Discord billing copies require separate operator deletion and have no automatic account-erasure bridge. Private channel permissions and applicable account terms require operator verification. Discord describes its own controller role in its published privacy policy; no executed processor agreement, sensitive-data authorization or zero-retention commitment has been established by this integration. Support source erasure requests deletion of the corresponding thread; provider retention and administrator copies are separate.

OpenAI Codex (managed-app fulfillment)

Coordinate managed-app fulfillment using a separate read-only feed of minimized purchase and recorded operational status. The retired platform support worker no longer starts Codex sessions.

• Data it can see: Managed app fulfillment status and operator planning
• Processing region: Processing locations governed by the configured provider account terms; no regional restriction configured.
• When it is in the path: Only when a platform administrator enables this support integration
• Role: Depends on the configured account and its applicable terms; an account-specific processor agreement has not been verified.
• Data-protection terms: https://openai.com/policies/privacy-policy/

Off by default. The independent fulfillment collector uses a separately configured Codex account. Its subscription, workspace controls, retention and model-training settings must be checked for every account; the separate OpenAI API entry does not establish those terms. Managed-app case tracking persists until operator cleanup, without automatic age expiry. Its feed excludes business documents, emails, signatures, payment links, raw errors, credentials and secret references. The feed grants no mutation, messaging, production deployment or store-submission authority. Workspace cleanup does not establish provider-side zero retention. Historical platform support sessions and source patches retained after retirement are described in the platform support data category; no replacement support execution provider is enabled by this entry.

OpenAI Codex (local T3 support) · handles client data

Work on eligible platform support tasks and sanitized monitoring findings in ordinary coding threads when the operator enables the local T3 connector and selects Codex.

• Data it can see: Platform support messages and engineering review
• Processing region: Processing locations governed by the configured provider account terms; no regional restriction configured.
• When it is in the path: Only when a platform administrator enables this support integration
• Role: Depends on the configured account and its applicable terms; an account-specific processor agreement has not been verified.
• Data-protection terms: https://openai.com/policies/privacy-policy/

The connector sends an existing bounded task brief and canonical case/source links through the operator-controlled T3 instance. The brief may contain personal or health information supplied in support text. It does not fetch private attachments or transfer raw Sentry webhook bodies. T3 is locally operated software, not a separate hosted processor for this handoff. The selected Codex account receives the task and later coding-session context. Subscription or API account terms, workspace controls, retention and model-training settings must be verified for that account; the separate OpenAI API disclosure does not establish Codex subscription terms or an executed data-processing agreement. Local T3 history, provider sessions, worktrees and code changes have their own retention. LaunchSite source erasure and case closure do not automatically erase them. This integration does not establish a regional restriction or zero retention.

TypeSafe AI (Jev) · handles client data

CRM Jev analysis and Ghost Opportunities are unavailable while the separate OS module is coming soon. Platform administrators can enable classification of bounded platform support conversations into bug, feature, human-support, no-action and uncertain categories; if an operator selects the Azure example-based support classifier instead, Jev classifies only the conversations that classifier fails to answer, and for community channel scans it then only groups each message with an earlier case unless that classifier fails. Optional community intake classifies up to 12 Discord member messages per request with bounded earlier context and request-local aliases, including members without LaunchSite accounts; it reserves at most one batch per channel every five minutes with a separate ceiling of 864 requests per day across up to three channels. Inspected screenshot observations can accompany message text, including image-only reports; unread media-only chatter makes no Jev request; cached decisions delayed by cleanup are reused. Platform support classification is paid by LaunchSite, does not bill coach credits, does not mark messages read, and cannot approve a build or release.

• Data it can see: Prospect, lead, and CRM contact information; Messages and conversation content; Connected mailbox correspondence; AI prompts, outputs, and workspace memory; LaunchSite OS business contacts and activity; Platform support messages and engineering review
• Processing region: Processing locations governed by TypeSafe account terms; no regional restriction configured.
• When it is in the path: For the coach feature this entry describes, or when a platform administrator enables a support integration
• Data-protection terms: https://typesafe.ai/legal/data-processing

No CRM Jev requests or Ghost background analysis run while the separate OS module is held, including for administrators. Previously saved classifications, source references and coach corrections remain subject to CRM retention, export and deletion rules. Platform support classification remains available with bounded support text and request-local aliases as described above. Free-text support correspondence may contain sensitive information. TypeSafe publishes a no-training commitment and offers enterprise zero data retention, but account-specific agreement execution, sensitive-data terms and zero retention have not been verified. Published DPA sensitive-data schedule states N/A; operators must confirm applicable terms with counsel before using sensitive correspondence. Outcome prediction training stays within LaunchSite and does not send records to TypeSafe.

Twilio · handles client data

Business-specific phone subaccounts, country and number discovery, phone provisioning, owner-approved business identity and sender registration, SMS delivery and receipts, and telephone transport for explicitly enabled phone agents.

• Data it can see: Business phone messages, calls and usage billing
• Processing region: Provider and carrier locations depend on number country and routing; no country-specific data residency guarantee is made by this integration.
• When it is in the path: For the coach feature this entry describes, or when a platform administrator enables a support integration
• Data-protection terms: https://www.twilio.com/en-us/legal/data-protection-addendum

Twilio publishes a Data Protection Addendum. This register does not confirm execution of account-specific terms. SMS bodies, numbers, call audio and routing metadata reach Twilio and downstream carriers. Local deletion and agent disablement do not remove provider records or cancel number rental. Owner-approved business registration identifiers, addresses, representative contacts, sample messages and consent-flow details reach Twilio for identity and sender review. Registration and country-specific documentation require provider approval. No customer phone number is shared across unrelated businesses.

Google Ads (optional public-site measurement)

Measure visits to selected LaunchSite marketing pages and whether an advertisement led to a new coach signup or a first paid platform subscription.

• Data it can see: Optional public-site advertising measurement
• Processing region: Global, including the United States
• When it is in the path: Only after a visitor allows public-site measurement
• Role: Independent controller under its published terms.
• Data-protection terms: https://business.safety.google/adscontrollerterms/

The tag loads only after a visitor allows measurement on selected public marketing and signup pages at launchsite-os.com. It does not run in coach or client workspaces, coach-owned sites, or development environments. Ad personalization and enhanced conversions are disabled. We do not send names, email addresses, form contents, client records, or health information. Google receives the measurement data described in the Privacy Policy as an independent controller under its applicable terms, rather than as a processor of coaching records. The linked terms describe the service; they do not certify that an agreement has been executed.