Subprocessors and Measurement Providers

Supabase · handles client data

Primary database, authentication, and file storage (lab files, progress photos), including private companion preferences, document metadata and text, source provenance and plan activation history.

• Data it can see: Public reference research for the client companion; Private client workspace and optional AI; Optional WordPress hosting and Shopify catalog connections; Connected mailbox correspondence; Account and profile information; Client wellness and health-related records; Lab files and extracted markers; Historical chart tables and saved charts; Progress photos and movement video; Connected device and wearable metrics; Messages and conversation content; Voice input, call recordings, transcripts, and synthetic voice; Prospect, lead, and CRM contact information; LaunchSite OS business contacts and activity; Campaign and engagement records; AI prompts, outputs, and workspace memory; Usage, device, and diagnostic data; Public AI demo requests; Network membership, learning paths and imports
• Processing region: United States
• When it is in the path: Always active
• Data-protection terms: https://supabase.com/legal/dpa

Stores the bulk of client data. Encrypted in transit and at rest; access scoped by row-level security. Network records include coach-owned shelf folder names, descriptions and listing placement, verified invitation onboarding and retained historical signup requests, pending invitation email addresses and hashed tokens, course and cohort organization, membership history and anonymous daily request totals. Import confirmation receipts contain status and references, not source content.

Microsoft Azure (Container Apps, App Service, MySQL, Blob Storage, Key Vault, Application Insights, Log Analytics) · handles client data

Application and optional isolated WordPress hosting, databases and backups, large-file and managed-app secret storage, private client document originals and course-derived audio, performance monitoring, and error logging.

• Data it can see: Public reference research for the client companion; Private client workspace and optional AI; Optional WordPress hosting and Shopify catalog connections; Coach-controlled hosted WordPress content; Connected mailbox correspondence; Account and profile information; Client wellness and health-related records; Lab files and extracted markers; Historical chart tables and saved charts; Progress photos and movement video; Messages and conversation content; Voice input, call recordings, transcripts, and synthetic voice; Prospect, lead, and CRM contact information; LaunchSite OS business contacts and activity; AI prompts, outputs, and workspace memory; Usage, device, and diagnostic data; Public AI demo requests; Business identity for a white-label app listing; Network membership, learning paths and imports
• Processing region: United States
• When it is in the path: Always active
• Data-protection terms: Microsoft Products and Services Data Protection Addendum (DPA).

Application Insights receives timing and diagnostic traces only - never prompt, reply, or document text. The Log Analytics workspace additionally holds 30 days of request failure records, which include the requesting IP address and user-agent, but no request or response bodies. Key Vault holds provider credentials for managed coach apps; the application database stores only opaque vault references. The application processes shelf folder names, descriptions and listing placement for authorized browsing. Network import files are read transiently by document parsers in the application host. Confirmed extracted course text is stored privately in Blob Storage, and Network database records follow the existing backup path. This parsing does not send invitation CSVs or course source files to an AI provider.

Sentry

Application error monitoring.

• Data it can see: Usage, device, and diagnostic data
• Processing region: United States
• When it is in the path: Always active
• Data-protection terms: https://sentry.io/legal/dpa/

Configured to exclude request bodies, cookies, and personal data from error events.

Microsoft Azure AI Services (including Azure OpenAI and Foundry Models) · handles client data

AI-assisted drafting, coach-requested bulk client-record sorting and proposed roster matching before import, embeddings, image generation, audio transcription, OCR and document-layout extraction for uploaded lab reports, retrieval-only context generation and relevance reranking for coach documents, private Zyx goal reviews and optional progress-photo observations, answering paid independent and coach-sponsored client questions from authorized knowledge and private documents, personalized client briefs, owner-enabled course audio transcription, turning a coach’s recorded demonstration into a Launch Bot’s written instructions and tool list, the public meal-plan demo on the marketing site, transient screenshot inspection for configured Discord platform-support intake channels, separating the distinct requests in a Discord community triage card an administrator chooses to plan, and, only when an operator selects it, labelling platform support evidence by comparison with fictional labelled examples.

• Data it can see: Public reference research for the client companion; Private client workspace and optional AI; Connected mailbox correspondence; Client wellness and health-related records; Lab files and extracted markers; Messages and conversation content; Voice input, call recordings, transcripts, and synthetic voice; Prospect, lead, and CRM contact information; LaunchSite OS business contacts and activity; AI prompts, outputs, and workspace memory; Progress photos and movement video; Public AI demo requests; Pages and optional screen images Co-Work uses; Recorded demonstrations of a coach’s own workflow; Platform support messages and engineering review; Network membership, learning paths and imports
• Processing region: Global processing (Azure resources are located in the United States).
• When it is in the path: Always active
• Data-protection terms: Microsoft Products and Services Data Protection Addendum (DPA).

When selected as the existing AI provider, this service receives bounded, orientation-normalized AI Memories photo copies without image metadata, including up to two overlapping detail crops within the same total byte limit, to extract visible text, tables and factual descriptions. LaunchSite stores originals in Library and indexes derived text under the existing coach, team and client scope. The private client companion can send bounded authorized coach or course passages, client-owned document text, presentation preferences and relevant client records to the configured AI model after consent and allowance checks. Course transcription is separately enabled by the lesson owner, sends bounded extracted audio segments to the configured transcription model and uses the existing coach AI allowance ledger. Stored course-derived audio and transcripts follow the source lifecycle; this differs from personal voice-message audio, which the server does not persist. Public web research sends only fixed topic labels to search and public URLs to the page reader, then can include bounded public evidence in the AI answer. When Azure is the configured Juno provider, requested shelf reads can also send owned folder names, descriptions and listing placement. When Azure is the configured Juno provider, an owner-requested Network growth conversation can send the coach instructions, authorized aggregate report counts, course and cohort labels and dates, member counts, synthetic launch checks, and membership plan terms. These growth tools exclude cohort member identities, invitation email lists and tokens, imported source files and raw Stripe identifiers. Import preview and confirmation use application document parsers, not AI. An explicitly confirmed Juno plan action saves an unpublished draft only; provider retention and existing assistant conversation retention still apply. The optional Discord screenshot reader sends bounded, normalized still-image bytes transiently to the configured Azure vision model. LaunchSite retains derived observations and content-free usage with the report lifecycle, not image bytes, signed links or raw model traces. Derived observations may be shared with the existing triage and engineering providers. When an administrator chooses Plan it on a private Discord triage card, the card's community message text (at most 12 messages, each cut to 600 characters), screenshot flags and any stored screenshot observations are sent once to the configured Azure chat model, under request-local aliases rather than Discord or LaunchSite identifiers, at most 96 times a day; the model returns short request titles and which messages belong to each request. LaunchSite keeps the validated titles with the private card until a source message on it is detected as edited or deleted or its text expires, plus content-free usage, never the raw model response. Any failure plans the card as one case instead. Jev remains the default platform support classifier. When an operator sets the server setting SUPPORT_CLASSIFIER to the example-based classifier, each classification of platform inbox, support chat, bug report or community case evidence (within the existing limit of 200 classifications a day) sends the new support text (at most 12 messages, each cut to 4,000 characters), up to 8 earlier messages cut to 500 characters, any stored screenshot observations and 6 to 10 fictional labelled examples once to the configured Azure chat model. Discord message links are removed and participants are labelled only as requester or staff. LaunchSite keeps the label, confidence, version, model name and token counts with the classification job, never the model's short reason or the raw response. The same setting also labels the scheduled scan of operator-selected community Discord channels: at most 300 scan batches a day, one request per new channel message with text or read screenshots (at most 12 messages a batch, each cut to 4,000 characters, with up to 8 earlier channel messages cut to 500 characters as context), fenced the same way, without Discord identifiers or author names. Jev still decides whether a message belongs to an earlier case, and any failure or a spent daily budget labels the whole batch with Jev. Only the label, confidence and content-free usage (model name, request and token counts, a failure code) are kept for those requests. Any failure falls back to Jev. A coach-requested email reply draft sends only a bounded portion of the selected mailbox thread and coach writing instructions. It does not save or send email, and mailbox content is not used for general model training. The admin lab OCR workbench also sends transient OCR text for marker transcription and marker-derived queries for platform reference retrieval. It displays assembled analysis inputs without generating or saving a review. When the lab OCR lane is enabled, the full uploaded lab PDF is sent to Azure Document Intelligence and Azure returns page text, confidence and layout coordinates; those results are used to create reviewable marker facts, and provider response bodies are not written to application logs. LaunchSite requests deletion of the provider-side analyze result after retrieval; Microsoft documents automatic deletion after 24 hours when early deletion is not confirmed. Microsoft states that prompts and outputs for models sold directly by Azure are not made available to the model provider. Context generation sends a coach document to the same Azure-operated service and stores its output separately from the clean source passage; generated context is used only to retrieve, and is never shown or cited as evidence. Reranking sends the search query and a bounded candidate set to an Azure-hosted model and stores no provider response as source evidence.

Anthropic · handles client data

AI-assisted drafting and analysis, including private Zyx goal reviews and optional progress-photo observations when this provider is selected. Operator-enabled Claude Code sessions advise and independently review bounded platform support work and minimized managed-app fulfillment plans through self-hosted OpenRig. Support evidence can include reports from separately enabled Discord community intake, including members without LaunchSite accounts, and related repository work checked before a new plan or implementation.

• Data it can see: Public reference research for the client companion; Private client workspace and optional AI; Client wellness and health-related records; Lab files and extracted markers; Messages and conversation content; Prospect, lead, and CRM contact information; LaunchSite OS business contacts and activity; AI prompts, outputs, and workspace memory; Progress photos and movement video; Platform support messages and engineering review; Managed app fulfillment status and operator planning
• Processing region: United States
• When it is in the path: Always active
• Data-protection terms: https://www.anthropic.com/legal/commercial-terms

Application requests use the configured Anthropic endpoint, including Azure-hosted Foundry when configured; the SDK can use the commercial Anthropic API when no custom endpoint is set. The separately enabled OpenRig advisor and reviewer use a dedicated Claude Code account and receive the same bounded support evidence as the Codex builder, including up to 8 screenshots downloaded from a community case's source messages, or the minimized fulfillment facts described in that data category. No provider credentials or raw managed-app intake documents are included in the fulfillment feed. Claude Code account terms, retention, workspace controls and model-training settings must be verified separately; the application API configuration does not establish those terms. Local support-job cleanup does not establish provider-side erasure, and fulfillment case history remains until operator cleanup. Provider retention and model-training handling depend on the applicable service configuration and terms. LaunchSite does not use client health information to train models.

Resend

Transactional, campaign and review-request email delivery, coach-domain verification and sending-key provisioning, fixed administrator test messages, and delivery, engagement, bounce and complaint webhooks.

• Data it can see: Account and profile information; Messages and conversation content; Campaign and engagement records; Prospect, lead, and CRM contact information; LaunchSite OS business contacts and activity
• Processing region: United States
• When it is in the path: Always active
• Data-protection terms: https://resend.com/legal/dpa

Managed coach apps use separate verified domains and domain-scoped sending keys within the LaunchSite Resend account. The one-time key value is transferred directly to Azure Key Vault. A platform administrator may send a fixed provisioning test to a chosen recipient; Resend receives that address and message.

Amazon Web Services (Simple Email Service)

Alternate transactional, campaign and review-request email delivery path.

• Data it can see: Account and profile information; Messages and conversation content; Campaign and engagement records
• Processing region: United States
• When it is in the path: Always active
• Data-protection terms: https://aws.amazon.com/service-terms/

Apple and Google (sign-in)

Verifying who you are when you sign in with "Continue with Apple" or "Continue with Google" instead of a password.

• Data it can see: Account and profile information
• Processing region: United States
• When it is in the path: Always active
• Data-protection terms: https://developer.apple.com/support/terms/apple-developer-program-license-agreement/

Offered on the web login page and in the mobile app, and only in the path for a user who chooses one of those buttons - a password sign-in involves neither. The provider tells us the email address and a stable identifier for the account (Google also shares the account’s name and profile picture), and learns that you signed in to LaunchSite OS; it receives no health, message, or coaching data. Apple users may substitute a private relay address, which works exactly like any other address here. In the mobile app, signing in this way only opens a coach or client account that already exists for that email address; anything else is signed back out. On the web, a Google sign-in that matches no account can continue to coach signup, and the account is created only if the person completes it. Our authentication provider keeps the sign-in identity it records, including for a sign-in that leads to no account, until deletion is requested.

Stripe

Subscription billing, including the separate Pro CRM add-on and CRM website-domain subscriptions, payment processing (including managed mobile app setup and maintenance), template and reusable-course marketplace payouts to coaches (Stripe Connect), one-time CRM and Networks website payments and course-access bundles on coach connected accounts, and payment for consultations booked on a coach’s public booking page.

• Data it can see: Account and profile information; Subscription and payment information; Prospect, lead, and CRM contact information; LaunchSite OS business contacts and activity
• Processing region: United States
• When it is in the path: Always active
• Data-protection terms: https://stripe.com/legal/dpa

Processes billing data (name, email, card) only - no client health data. Coaches who sell through the marketplace complete Stripe Connect onboarding directly with Stripe, which collects the identity and bank details required by financial regulation. When a coach charges for a call on their public booking page, the charge is taken DIRECTLY on that coach’s own connected account with no platform fee - the coach is the merchant of record and the funds never enter a LaunchSite balance. Card details are entered on Stripe’s own hosted checkout and are never seen or stored by LaunchSite; we keep only the amount, the currency, whether it was paid, and Stripe’s session identifiers. Shared website offers also charge directly on the selling coach connected account with no platform fee in this flow. Stripe receives the offer name, amount, currency and opaque order identifier; lesson content and learner assessment data are not included. Verified payment and full-refund events update purchase access. These one-time offers are separate from recurring subscriptions and the coach Marketplace fee. For managed coach apps, a permanent purchase-specific payment link opens Stripe Checkout. Expired checkout sessions can be renewed using the same approved purchase, saved prices, and Stripe Customer; the shared payment link has no scheduled expiry. CRM website-domain purchases use a separate recurring Stripe subscription; LaunchSite keeps the selected domain and provisioning state, while Stripe receives billing details.

n8n

Internal workflow automation for our own outbound marketing operations.

• Data it can see: Prospect, lead, and CRM contact information; LaunchSite OS business contacts and activity
• Processing region: United States
• When it is in the path: Always active
• Data-protection terms: Available on request.

Used by LaunchSite OS for our own prospect outreach. It is not part of a coach’s workspace and sees no client data.

GitHub (Microsoft) · handles client data

Source control, automated provisioning of coach site repositories, CI runners that build, test, and deploy the application, private storage of retrieval evaluation reports, and draft pull requests from administrator-approved support plans.

• Data it can see: Optional WordPress hosting and Shopify catalog connections; Account and profile information; Client wellness and health-related records; Lab files and extracted markers; Progress photos and movement video; Connected device and wearable metrics; Messages and conversation content; Voice input, call recordings, transcripts, and synthetic voice; Prospect, lead, and CRM contact information; LaunchSite OS business contacts and activity; Campaign and engagement records; AI prompts, outputs, and workspace memory; Usage, device, and diagnostic data; Public AI demo requests; Business identity for a white-label app listing; Platform support messages and engineering review; Network membership, learning paths and imports
• Processing region: United States
• When it is in the path: Always active
• Data-protection terms: https://github.com/customer-terms/github-data-protection-agreement

Engineering infrastructure. The nightly production database backup is produced on a GitHub-hosted runner, so the database contents transit that runner before being written to Azure Blob and shredded; file contents in Supabase Storage (lab documents, progress photos) are not part of that dump, only the rows describing them. GitHub does not appear on Microsoft's published HIPAA BAA in-scope service list, and GitHub's Data Protection Agreement s12.B asks that protected health information not be provided without GitHub's prior written consent. Retrieval evaluation runs on the same private runner/artifact boundary. Its report contains aggregate rank metrics, committed golden questions, bounded expected-answer excerpts for misses, source names, and corpus counts; it does not copy retrieved candidate passages or user-authored search queries. Optional WordPress provisioning decrypts the bootstrap administrator and database credentials into a restricted temporary runner file, provisions Azure, and removes the file at job completion. No website backups are imported through this runner. Managed-app provisioning also runs on a GitHub-hosted runner: validated coach artwork and public app configuration are committed to a generated source pull request, while the Apple private key is retrieved from Key Vault into a temporary runner file and deleted at the end of the job.

Shopify

Coach-authorized store identity and product catalog access; Shopify continues to operate the store and checkout.

• Data it can see: Optional WordPress hosting and Shopify catalog connections
• Processing region: Processing locations governed by the merchant’s Shopify agreement.
• When it is in the path: Only if a coach connects it
• Data-protection terms: https://www.shopify.com/legal/dpa

The connection requests read_products only. LaunchSite does not retrieve customers or orders, process Shopify payments, or send coaching or health records to Shopify. Referencing the published addendum does not establish an executed account-specific agreement.

Firecrawl (SideGuide Technologies, Inc.)

Read public reference articles for requested Scientist research and paid client companion answers after general-library retrieval.

• Data it can see: Public research for coaching briefs; Public reference research for the client companion
• Processing region: United States (per published privacy policy)
• When it is in the path: Only for a coach or client who uses the optional feature
• Data-protection terms: Published privacy terms: https://www.firecrawl.dev/privacy-policy. A DPA and account-specific execution have not been verified; request and review them with the vendor.

Receives public research article URLs selected by Scientist or the client companion and fetches their public content. Companion research uses fixed public topic labels and reads at most three pages from an enumerated reliable-host list; freeform client questions, names, lab values and private records are not sent to search or this page reader. Lead Scout does not use this provider. The integration sends no coach account identifiers, private workspace records, cookies or target-site credentials. Scrape caching is disabled, which does not establish zero retention for provider logs. Provider retention and deletion require separate review.

Fullscript · handles client data

Optional coach-selected storefront, authorized practice connection and official practitioner editor. Fullscript handles its own onboarding, supported plan authoring, payment and fulfillment. LaunchSite sends the authorized practitioner credential and verified matched patient identifier, synchronizes released directions, patient-facing messages and resource references, and may read permitted order and eligible lab recommendation/status data. Coaches can author through the official embedded Fullscript interface when the provider enables it. Clients can read supported assignments in LaunchSite; checkout remains in Fullscript. An explicitly confirmed patient-creation request sends only reviewed first name, last name and email, suppresses the provider welcome email and returns a candidate for separate matching.

• Data it can see: Account and profile information; Client wellness and health-related records; Subscription and payment information; Usage, device, and diagnostic data; Optional Fullscript plans, resources and practice connection
• Processing region: External service; processing locations are described in Fullscript’s privacy statement.
• When it is in the path: Only if a coach connects it
• Role: Independent controller under its published terms.
• Data-protection terms: https://fullscript.com/legal/privacy

Independent-controller classification describes Fullscript’s own practitioner, patient and commerce service; account-specific API roles and contractual obligations still require review before real-data production use. No executed DPA, BAA, clinical-use approval or production commercial approval has been verified. Sandbox testing uses synthetic records and does not change LaunchSite’s wellness-only policy. Tokens are encrypted server-side; embedded session grants expire quickly. The integration never publishes OAuth credentials, private invitation or checkout links, or stored attachment URLs. Lab result sharing is not implemented. Direct Fullscript projections and marked derived checklists are excluded from general AI plan retrieval and AI edits. Fullscript may independently send notifications and process information under its own terms.

Cloudflare

DNS, domain registration, and custom-domain provisioning for coach sites.

• Data it can see: Account and profile information
• Processing region: Global edge network
• When it is in the path: Only if a coach connects it
• Data-protection terms: https://www.cloudflare.com/cloudflare-customer-dpa/

Receives the registrant details a coach supplies when they register or connect a domain. ICANN requires those details for registration; it sees no client health data.

OpenAI · handles client data

Hosted AI Atelier website and funnel planning, drafting, visual review, brand extraction, creative project file editing with explicitly selected picture and visual-reference image contents, and optional original image generation guided by selected reference images; Juno network and course drafting from a coach description and explicitly selected file references, including image analysis and optional banner and logo generation; Realtime and GPT-Live voice sessions for the co-work surface, including the Responses model a Live session delegates tool use to; and writing a coach’s recorded Loom check-in review into its structured written review through the direct OpenAI API.

• Data it can see: Public reference research for the client companion; Private client workspace and optional AI; Voice input, call recordings, transcripts, and synthetic voice; Client wellness and health-related records; AI prompts, outputs, and workspace memory; Progress photos and movement video; Optional AI network setup; Network membership, learning paths and imports
• Processing region: United States
• When it is in the path: Only if a coach connects it
• Data-protection terms: https://openai.com/policies/data-processing-addendum

API terms: inputs and outputs are not used to train models. Optional private client AI may use the direct API when that endpoint is configured; the ordinary configured Azure path is covered under Azure above. The Draft from Loom lane sends the captured Loom transcript and the client context for that check-in to OpenAI; the transcript text is deleted from our storage once the review is approved, and OpenAI does not retain API inputs for training. When Juno uses the direct OpenAI endpoint, requested shelf reads can also send owned folder names, descriptions and listing placement. When Juno uses the direct OpenAI endpoint, an owner-requested Network growth conversation can send coach instructions, authorized aggregate report counts, course and cohort labels and dates, member counts, synthetic launch checks, and membership plan terms. These growth tools exclude cohort member identities, invitation email lists and tokens, imported source files and raw Stripe identifiers. Import preview and confirmation use application document parsers, not AI. An explicitly confirmed Juno plan action saves an unpublished draft only; provider retention and existing assistant conversation retention still apply. This is separate from the optional file-assisted Network builder described above.

Unipile · handles client data

Connected WhatsApp and Instagram conversations and coach-configured conversation workflows in paid Pro CRM.

• Data it can see: Client wellness and health-related records; Messages and conversation content; Prospect, lead, and CRM contact information; LaunchSite OS business contacts and activity
• Processing region: European Union
• When it is in the path: Only if a coach connects it
• Data-protection terms: https://www.unipile.com/dpa/

Active for connected social conversations, which can include health information supplied by correspondents. Email connections now use direct Google and Microsoft authorization and APIs; LaunchSite no longer requests mailbox data or sends email through Unipile. Historical grants in a provider account may require separate removal by the account owner.

Meta Platforms (Instagram messaging) · handles client data

Direct Instagram connection in paid Pro CRM through Meta’s Instagram API with Instagram Login. A coach authorizes their Instagram professional account, Meta delivers the direct messages people send that account, and LaunchSite sends the coach’s replies, media and reactions, and replies from coach-configured workflows and AI lead agents, through Meta.

• Data it can see: Client wellness and health-related records; Messages and conversation content; Prospect, lead, and CRM contact information; LaunchSite OS business contacts and activity
• Processing region: United States / global
• When it is in the path: Only if a coach connects it
• Data-protection terms: https://www.facebook.com/legal/terms/dataprocessing

Separate from Unipile and from the Facebook and Instagram business accounts entry. Offered only where LaunchSite has enabled direct connection; an Instagram account already connected through Unipile keeps working there until the coach reconnects it directly. Conversations can include health information supplied by correspondents. Meta serves only the 20 most recent messages of a conversation, so LaunchSite stores the conversations of a directly connected account, including each correspondent’s Instagram-scoped id, username, name, profile picture address and whether they follow the account, and imports its most recent conversations when it is connected. Media a person sends is fetched from Meta when it is viewed rather than copied; media the coach sends is copied to private storage, and Meta fetches it through a link that expires within 15 minutes. The long-lived access token is encrypted in our database. Disconnecting, or a data deletion request Meta forwards for the account, deletes the stored credential, conversations and messages for that account and the coach’s media copies (a copy that cannot be removed is logged for follow-up). Meta’s deauthorization notice destroys the access token and leaves the conversations until one of those happens. The applicable Meta messaging terms require operator verification before production activation; this entry does not represent an executed agreement.

Meta Platforms (WhatsApp Business Platform)

WhatsApp message delivery and inbound webhooks.

• Data it can see: Messages and conversation content; Prospect, lead, and CRM contact information; LaunchSite OS business contacts and activity
• Processing region: United States / global
• When it is in the path: Only if a coach connects it
• Data-protection terms: https://www.whatsapp.com/legal/business-data-processing-terms

Meta Platforms (Facebook and Instagram business accounts)

Connect authorized business assets, retrieve public Facebook recommendations, ad spend and selected lead-form submissions, publish coach-approved review replies and scheduled Facebook/Instagram content, and return observed engagement.

• Data it can see: Account and profile information; Prospect, lead, and CRM contact information; LaunchSite OS business contacts and activity; Campaign and engagement records
• Processing region: United States / global
• When it is in the path: Only if a coach connects it
• Data-protection terms: https://www.facebook.com/legal/terms/dataprocessing

Separate from connected inbox messaging. OAuth credentials are encrypted in our database; the browser receives account names, identifiers and connection status. Each discovered account starts disabled until the coach selects it. Disconnecting clears stored credentials. The applicable Meta contractual terms require operator verification before production activation; this entry does not represent an executed agreement.

Apple, Google, and Mozilla push services

Delivery of web and mobile push notifications to your own device.

• Data it can see: Usage, device, and diagnostic data
• Processing region: Global
• When it is in the path: Only if a client connects it
• Data-protection terms: Available on request.

A push service receives an opaque device token and the notification payload. Notification copy is written to avoid carrying health details.

Expo · handles client data

Managed mobile project creation, cloud builds, over-the-air updates, App Store connection and submission, and push notification delivery.

• Data it can see: Usage, device, and diagnostic data; Business identity for a white-label app listing
• Processing region: United States
• When it is in the path: Only if a coach connects it
• Data-protection terms: https://expo.dev/terms

For a managed coach app, Expo receives its public app configuration, bundle/package identifiers, generated artwork and the Apple organization credential used for non-interactive build or submission work. Provider secrets are materialized only on the runner and are not committed to source.

Google · handles client data

Two-way Calendar sync for a coach, coach-requested network event creation, updates and cancellation with a Google Meet link (event title and times, without member identities or invitations), including a Calendar invitation sent from the coach’s own calendar to a person who books with them (their name, email, the appointment time, the meeting link, their own booking note and a cancel link), read-only Calendar display for a client who connects their own account, busy-time checks so booking pages offer only open times, Drive file browsing and import of coach-selected files into the coach library (Google Docs, Slides, Sheets and Drawings exported as PDF), import of Google Meet transcripts for meetings LaunchSite scheduled with a Meet link, separately authorized discovery of Google Business Profile locations and Google Ads accounts, retrieval of business reviews, daily advertising performance and selected lead-form submissions, and publication of review replies the coach explicitly submits, plus direct Gmail inbox reading, provider drafts, coach-approved sending, read/star/archive actions and matched CRM synchronization.

• Data it can see: Private client workspace and optional AI; Account and profile information; Client wellness and health-related records; Voice input, call recordings, transcripts, and synthetic voice; Prospect, lead, and CRM contact information; LaunchSite OS business contacts and activity; Campaign and engagement records; Connected mailbox correspondence; Messages and conversation content
• Processing region: United States
• When it is in the path: Only if a coach connects it
• Data-protection terms: https://cloud.google.com/terms/data-processing-addendum

Gmail authorization is separate from Calendar, Drive and Meet. Mailbox grants are encrypted server-side. Draft content stays in Gmail; LaunchSite keeps draft identifiers, content fingerprints and send outcomes. Correspondence reaches AI providers only through the features the Privacy Policy’s Google user data section describes (draft assistance, Jev insights including opt-in background analysis, and AI lead agents), and is not used to train generalized models. Applicable consumer or Workspace account terms and restricted-scope verification require operator review; this entry does not assert a signed agreement for every account. Only for users who connect it. A client may connect their own Google Calendar to see their own events in the app; those events are read on demand for display and are not stored. Calendar event reads and writes target the primary calendar. Isolated OAuth reviewer accounts can request owned-calendar scopes before their public rollout; client grants remain read-only. Calendar is a sensitive scope; the Drive scope is restricted, and Drive and Meet are coach-only. Google API Calendar, Drive and Meet data is used only to provide those connected features, never for advertising or model training. Marketing connections use separate consent and encrypted credentials; they do not repurpose Calendar or Drive data. A coach selects which discovered business locations and advertising accounts the workspace may use.

Microsoft Graph (Outlook and Microsoft 365) · handles client data

Owner-authorized mailbox reading, native draft storage, coach-approved sending, read/flag/archive actions and matched CRM synchronization.

• Data it can see: Account and profile information; Messages and conversation content; Prospect, lead, and CRM contact information; Connected mailbox correspondence
• Processing region: United States / global; depends on the connected account
• When it is in the path: Only if a coach connects it
• Data-protection terms: https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA

Users authorize delegated mailbox access through Microsoft. Credentials are encrypted server-side. Mailbox lists and plain-text threads are fetched for display; provider drafts and sent messages remain in the mailbox. Only eligible correspondence matched to one CRM lead is copied into CRM history. The Microsoft DPA applies where the account contract provides it; consumer Microsoft accounts have their own terms. Account-specific contractual coverage and sensitive correspondence terms require operator and counsel review. Disconnect deletes local credentials and stops collection; it does not claim to remove the consent grant from the Microsoft account.

Zoom

Creating meetings for booked sessions, creating and managing coach-requested Network event meetings using their titles and times, and receiving meeting webhooks.

• Data it can see: Account and profile information; Prospect, lead, and CRM contact information; LaunchSite OS business contacts and activity; Messages and conversation content
• Processing region: United States
• When it is in the path: Only if a coach connects it
• Data-protection terms: https://explore.zoom.us/en/gdpr/

Network event meetings send only coach-entered titles and times. The workflow does not send client health records, event descriptions or attendee lists, and does not request recording. A coach-entered title can still contain sensitive information.

Whoop · handles client data

Wearable metric sync, at the client’s direction.

• Data it can see: Connected device and wearable metrics
• Processing region: United States
• When it is in the path: Only if a client connects it
• Data-protection terms: https://developer.whoop.com/

Oura · handles client data

Wearable metric sync, at the client’s direction.

• Data it can see: Connected device and wearable metrics
• Processing region: United States
• When it is in the path: Only if a client connects it
• Data-protection terms: https://cloud.ouraring.com/docs/

Fitbit (Google) · handles client data

Wearable metric sync, at the client’s direction.

• Data it can see: Connected device and wearable metrics
• Processing region: United States
• When it is in the path: Only if a client connects it
• Data-protection terms: https://dev.fitbit.com/legal/platform-terms-of-service/

Ultrahuman · handles client data

Wearable metric sync, at the client’s direction.

• Data it can see: Connected device and wearable metrics
• Processing region: United States
• When it is in the path: Only if a client connects it
• Data-protection terms: Available on request.

Apple (HealthKit) · handles client data

Reading approved Apple Health daily categories, including optional weight, and separately enabled workout summaries in the iOS app.

• Data it can see: Connected device and wearable metrics
• Processing region: On device; aggregates sent to our United States infrastructure
• When it is in the path: Only if a client connects it
• Role: On-device data source, not a cloud recipient of the summaries imported by this connection.
• Platform documentation: The device platform controls its permissions and source records.

Apple is the source, not a recipient: HealthKit data flows from the device to us after the client approves Apple’s permission prompt. Apple Health imports the latest valid weight measurement per local day within the last 90 days, stored in pounds as daily summaries. Connect or Sync requests weight read access; automatic collection never requests new permissions. Empty results can mean no source measurement or unavailable read access, which Apple does not distinguish. Apple Health daily sync reconciles only submitted categories and dates: missing values in that snapshot, including an empty successful snapshot, remove matching imported daily values. Unsubmitted categories and dates remain unchanged. The 90-day read window is not a retention limit. Apple’s platform rules prohibit using it for advertising or selling it, and we do neither.

Google (Android Health Connect) · handles client data

Read client-approved daily steps, sleep duration, resting heart rate and heart-rate variability (RMSSD) summaries from Health Connect in the Android app for wellness coaching.

• Data it can see: Connected device and wearable metrics
• Processing region: On device; approved daily summaries sent to our United States infrastructure
• When it is in the path: Only if a client connects it
• Role: On-device data source, not a cloud recipient of the summaries imported by this connection.
• Platform documentation: https://developer.android.com/health-and-fitness/health-connect

Health Connect is an on-device source, not a Google cloud recipient of this sync. After the client confirms the in-app explanation and grants Android read permissions, foreground sync reads at most the latest 30 local calendar dates, including today. LaunchSite receives daily summaries, not raw samples, and requests no write, background-read or older-history permission. RMSSD remains separate from Apple Health SDNN. Disconnecting deletes imported Health Connect summaries and keeps a provider block until an explicit reconnect; Android permissions can be removed separately in Health Connect settings. Revoking an individual category removes its retained imported summaries when the app next reconciles permissions. The linked platform documentation is not evidence of an executed data-processing agreement. Data already held by source apps or the device remains under their controls.

Loom

Embedding and drafting around coach-recorded walkthrough videos.

• Data it can see: Account and profile information
• Processing region: United States
• When it is in the path: Only if a coach connects it
• Data-protection terms: Available on request.

Apple App Store and Google Play (app updates)

Determine whether the installed mobile app has an available store update and open its exact listing when the client chooses Update now.

• Data it can see: Mobile app update availability
• Processing region: Store-service processing locations governed by Apple and Google account terms.
• When it is in the path: Only when a platform administrator enables this support integration
• Role: Independent controller under its published terms.
• Data-protection terms: Store terms and SDK disclosure: https://developer.android.com/guide/playcore/in-app-updates and https://www.apple.com/legal/internet-services/itunes/

The server sends Apple a public numeric app ID and App Store country; it sends no account token, client identity or coaching records. The Google Play In-App Update library processes device metadata, app version and module/asset information to determine availability and size; Google documents encrypted transfer. Installed native versions and Play eligibility are not uploaded to LaunchSite. These providers operate their stores under their own terms; this entry does not claim a processor agreement or regional restriction.

Discord (platform support) · handles client data

Notify platform support staff about platform inbox messages, support chats and bug reports, present engineering plans with administrator approval controls, receive explicit internal operator commands, and relay an administrator-written /message reply to its linked LaunchSite inbox or support chat. Separately enabled scheduled scans read bounded reports from operator-selected community channels, including posts by members without a LaunchSite account, and copy actionable evidence only to private support threads. Deliver minimized platform trial, invoice, cancellation, refund and dispute alerts to a separate private staff billing channel.

• Data it can see: Platform support messages and engineering review; Subscription and payment information
• Processing region: Processing locations governed by Discord terms; no regional restriction configured.
• When it is in the path: Only when a platform administrator enables this support integration
• Role: Independent controller under its published terms.
• Data-protection terms: https://discord.com/privacy

Disabled by default. Support notifications initially contain source type and opaque receipts only. Message content requires a separate operator switch; free-text support may contain health or personal information. Raw attachment bytes and signed links are not copied to private support threads or stored records. When screenshot intake is enabled, supported community screenshots are transiently transferred to Azure AI Services and bounded model-derived observations can be shared with existing support providers. An administrator's Plan it on a private triage card also sends that card's bounded message text and observations to Azure AI Services to separate its distinct requests into their own cases. When an operator selects the example-based support classifier, a community case's message text and observations are also classified through Azure AI Services without the Discord message link, and so are new messages found by the community channel scan. When the home worker supports it, an investigation or build of a community case re-reads its source messages without writing to them, and the worker downloads their still-image attachments from Discord's file host for the engineering sessions. Support automation alerts to a private administrator channel (a worker health check failing, a worker that stopped reporting, or a build or merge that stopped after approval) carry only fixed text, check and failure codes, counts, times, a short work item reference and a link to its private card, never support text, titles or credentials. Billing alerts have a separate enable switch and carry only opaque account/purchase and processor references, known product labels, amounts/currency and status/times. They exclude names, emails, card data, raw decline text, customer metadata and health content. Their local receipts become eligible for deletion after 90 days on the next active queue claim; disabled or misconfigured delivery does not run cleanup. Discord billing copies require separate operator deletion and have no automatic account-erasure bridge. Private channel permissions and applicable account terms require operator verification. Discord describes its own controller role in its published privacy policy; no executed processor agreement, sensitive-data authorization or zero-retention commitment has been established by this integration. Support source erasure requests deletion of the corresponding thread; provider retention and administrator copies are separate.

OpenAI Codex (platform support worker) · handles client data

Answer internal administrator support questions, investigate bounded platform support context and selected Discord thread history against the source repository, and implement an authorized plan through self-hosted OpenRig teams in isolated job containers. This includes reports from separately enabled community-channel intake, whose members may not be LaunchSite customers, and screenshots attached to their source messages. Check related repository work before planning or implementation. Coordinate managed-app fulfillment using a separate read-only feed of minimized purchase and recorded operational status.

• Data it can see: Platform support messages and engineering review; Managed app fulfillment status and operator planning
• Processing region: Processing locations governed by the worker account terms; no regional restriction configured.
• When it is in the path: Only when a platform administrator enables this support integration
• Role: Depends on the configured account and its applicable terms; an account-specific processor agreement has not been verified.
• Data-protection terms: https://openai.com/policies/privacy-policy/

Off by default. The worker uses dedicated stored Codex logins, up to eight per worker. Platform administrators can queue device sign-ins, reconnect, pause and reorder accounts from the support account console. Native credentials remain in worker-owned volumes; temporary device codes and operational metadata pass through the administrator-only coordinator. OpenRig runs on LaunchSite-controlled infrastructure and orchestrates the native Codex sessions; it is not a separate hosted AI recipient. Its ChatGPT subscription, workspace controls, retention and model-training settings must be checked for every account; the separate OpenAI API entry does not establish those terms. Support source context is bounded but can contain sensitive free text. Community case jobs can also include up to 8 screenshots from the source messages, which the session can open; screenshots can show personal or health information. Support-job queue, terminal, snapshot and native-session files are confined to each ephemeral job container and removed when it stops; downloaded screenshots stay in that job's worker files and are removed when the job ends. Managed-app case tracking is separate and persists until operator cleanup, without automatic age expiry. Its feed excludes business documents, emails, signatures, payment links, raw errors, credentials and secret references. Workspace cleanup does not establish provider-side zero retention. No coach AI credits are charged. Support work requires explicit administrator approval of the task before planning and of the exact plan before every implementation, including bug fixes. Merge requires separate approval; production deployment remains a separate step. The fulfillment feed grants no mutation, messaging, production deployment or store-submission authority.

TypeSafe AI (Jev) · handles client data

CRM classification of lead activity, permitted form answers, conversation text, and draft messages into structured recommendations, when a coach requests it and, only for coaches who turn on Ghost Opportunities background analysis (off by default), when new evidence arrives for an open opportunity. Separately, platform administrators can enable classification of bounded platform support conversations into bug, feature, human-support, no-action and uncertain categories; if an operator selects the Azure example-based support classifier instead, Jev classifies only the conversations that classifier fails to answer, and for community channel scans it then only groups each message with an earlier case unless that classifier fails. Optional community intake classifies up to 12 Discord member messages per request with bounded earlier context and request-local aliases, including members without LaunchSite accounts; it reserves at most one batch per channel every five minutes with a separate ceiling of 864 requests per day across up to three channels. Inspected screenshot observations can accompany message text, including image-only reports; unread media-only chatter makes no Jev request; cached decisions delayed by cleanup are reused. Platform support classification is paid by LaunchSite, does not bill coach credits, does not mark messages read, and cannot approve a build or release.

• Data it can see: Prospect, lead, and CRM contact information; Messages and conversation content; Connected mailbox correspondence; AI prompts, outputs, and workspace memory; LaunchSite OS business contacts and activity; Platform support messages and engineering review
• Processing region: Processing locations governed by TypeSafe account terms; no regional restriction configured.
• When it is in the path: Coach-requested CRM analysis or administrator-enabled platform support analysis
• Data-protection terms: https://typesafe.ai/legal/data-processing

Receives bounded text when a coach requests Jev analysis directly or through Nova, including for a batch of up to 25 opportunities the coach selects from a list. The workspace owner may also turn on Ghost Opportunities background analysis, which is off by default. Once it is on, the same bounded lead snapshot is sent without a click after a new inbound WhatsApp or Instagram message on a linked lead, a new email from a verified sender, or new form, quiz or intake answers arrive for an open opportunity. Synchronized mailbox email currently has no sender verification, so it does not start a background analysis, and website chat alone never starts one. Background analysis never runs for contacts held for review, excluded from Ghost Opportunities, opted out or awaiting email consent. It covers at most 200 opportunities a day, is paid from the coach’s own AI credits within a monthly Ghost cap (3 USD by default), and pauses once the coach’s usage reaches 80% of the monthly credit limit. A reading never moves an opportunity by itself: moves made from Ghost Opportunities or proposed by Nova need the coach’s confirmation, and an unreviewed background reading does not satisfy a workflow condition. A label the coach accepts can satisfy a workflow condition the coach set up, and that workflow may then move the opportunity. Direct contact identifiers are minimized, internal record identifiers use request-local aliases, and form answers excluded from AI use are withheld. Free-text correspondence may still contain sensitive information. Structured labels, source references and coach corrections are retained in the CRM; usage telemetry contains counts and timing, not message bodies. TypeSafe publishes a no-training commitment and offers enterprise zero data retention, but account-specific agreement execution, sensitive-data terms and zero retention have not been verified. Published DPA sensitive-data schedule states N/A; operators must confirm applicable terms with counsel before using sensitive correspondence. Outcome prediction training stays within LaunchSite and does not send records to TypeSafe.

Google Ads (optional public-site measurement)

Measure visits to selected LaunchSite marketing pages and whether an advertisement led to a new coach signup or a first paid platform subscription.

• Data it can see: Optional public-site advertising measurement
• Processing region: Global, including the United States
• When it is in the path: Only after a visitor allows public-site measurement
• Role: Independent controller under its published terms.
• Data-protection terms: https://business.safety.google/adscontrollerterms/

The tag loads only after a visitor allows measurement on selected public marketing and signup pages at launchsite-os.com. It does not run in coach or client workspaces, coach-owned sites, or development environments. Ad personalization and enhanced conversions are disabled. We do not send names, email addresses, form contents, client records, or health information. Google receives the measurement data described in the Privacy Policy as an independent controller under its applicable terms, rather than as a processor of coaching records. The linked terms describe the service; they do not certify that an agreement has been executed.