Our Subprocessors

As described in our Data Processing Agreement, FSM Navigator® engages a limited number of third-party service providers (“subprocessors”) to assist in delivering the Service.

Each subprocessor has been carefully evaluated to ensure it meets our security and data protection standards, as described in our Privacy Policy.

Subprocessors only have access to the data necessary to perform their specific function.

We maintain contractual agreements with each subprocessor requiring them to protect personal data to at least the same standard as this policy.

This list is updated whenever subprocessors are added, removed, or their scope of processing changes. For details about our security practices, see our Security & Trust page.

The following table lists the subprocessors engaged by FSM Navigator® as of the date indicated above.

Google Maps Platform. We also send information to Google Maps Platform. It is not on the list above because Google provides Maps services under its own terms, as an independent controller, and not as a subprocessor. To estimate drive times and distances for dispatch, to look up addresses, and to show the nearest street address for a technician on the dispatch map, we send street addresses and technician GPS coordinates (precise location) to Google Maps Platform. We send only what is needed to get the distance, travel time, or address back. Google does not pay us for this information, and we do not send it to Google for advertising. Google’s handling of the information it receives is described in the Google Maps Platform Terms of Service and Google’s Privacy Policy. See also “Location information and Google Maps Platform” in our Privacy Policy.

Services you connect with your own account. Some features send data to a provider that you choose and connect with your own account. These providers work for you under your own agreement with them. They are not subprocessors of FSM Navigator®, so they are not on the list above:

• Twilio (text notifications). Appointment and service texts are sent through your own Twilio account. We pass Twilio the customer’s phone number and the text of each notification, and Twilio and the mobile carriers deliver it under their own terms.
• Your AI assistant (AI Connector). When someone on your team connects an AI assistant, such as Claude or ChatGPT, that assistant can read the business data your account owner allows and save drafts and pending service requests for your team to review. Its provider handles that data under your agreement with it.
• Your webhook destinations. If you set up webhooks, we send event details about your work, customers, invoices and service requests to the web addresses you choose.
• Your analytics tag on your booking page. If you add a Google Analytics tag to a booking page on your own custom domain, Google acts for you. See our Data Processing Agreement.

Before engaging any subprocessor, we conduct a thorough evaluation that includes:

• Review of the subprocessor’s security policies, certifications, and compliance posture
• Assessment of data handling and encryption practices
• Verification that appropriate data processing agreements are in place
• Evaluation of the subprocessor’s incident response and breach notification procedures
• Ongoing monitoring of subprocessor compliance and security posture

The Service is offered only to businesses in the United States, and personal data is stored and processed in the United States. Our content delivery and security provider may route and inspect traffic at its edge locations worldwide while it is in transit; personal data is stored in the United States.

All subprocessors are required to maintain data protection standards equivalent to or exceeding our own.

We will update this page whenever a new subprocessor is added, an existing subprocessor is removed, or the scope of processing changes materially.

For customers with active Data Processing Agreements, the notice period and the way to object are set out in Section 7 of the Data Processing Agreement. We give at least thirty (30) days’ notice by updating this page, and by email to anyone who has asked to be notified.

Historical changes will be noted below the current subprocessor table where applicable.

If you have a legitimate concern about a new subprocessor, you may object as set out in Section 7 of the Data Processing Agreement, within thirty (30) days of the date this page is updated.

Objections should be sent to [email protected] with a detailed explanation of your concern.

We will work in good faith to address your concern, which may include proposing an alternative subprocessor or implementing additional safeguards.

If we are unable to resolve your objection, you may terminate the affected service in accordance with the Terms of Service.