Customer.io

Downstream

Who's behind Customer.io, as listed in its own subprocessor documents. 8 subprocessors.

Reviewer notes

Extracted by deterministic rules (rules/v1), no language model. Coverage is limited to recognisable clauses and a gazetteer of common subprocessors; absent values mean 'not matched', not 'not present'. no training clause matched

Documents read

• privacy policy https://customer.io/legal/privacy-policy/HTTP 200 · 2026-10-13
• subprocessors https://customer.io/legal/sub-processorsHTTP 200 · 2026-10-13
• dpa https://customer.io/legal/dpaHTTP 200 · 2026-10-13

Document changes

• low 2026-10-13 · dpa +0 / −1 lines
  show diff

  − Sign inGet startedGet startedBook a demoBook a demo
• low 2026-10-13 · subprocessors +0 / −1 lines
  show diff

  − Sign inGet startedGet startedBook a demoBook a demo
• low 2026-10-13 · privacy policy +0 / −1 lines
  show diff

  − Sign inGet startedGet startedBook a demoBook a demo
• high 2026-10-06 · subprocessors +3 / −1 lines
  show diff

  + Revised October 2026

  + https://www.infobip.com/policies/service-terms-conditions

  + Prior List of Subprocessors versionsView earlier versions and the dates they were in effect.

  − Revised March 2026
• low 2026-10-01 · dpa +1 / −1 lines
  show diff

  + If you require an executed DPA with us, please email privacy@customer.io

  − If you require an executed DPA with us, please sign here.
• high 2026-09-30 · dpa +16 / −12 lines
  show diff

  + Effective September 2026

  + We provide the latest version of the Customer.io DPA for you to download here on this page. You can find additional information regarding Customer.io’s compliance with GDPR, U.S. State Data Privacy Laws, and more information about our security practices here. For your convenience we have included the newest Standard Contractual Clauses (SCCs) within this document for co-execution.

  + 2.11. “European Data Protection Law” means: (i) Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such data (General Data Protection Regulation) (“EU GDPR”); (ii) in respect of the United Kingdom, the Data Protection Act 2018 and the EU GDPR as saved into United Kingdom law by virtue of Section 3 of the United Kingdom’s European Union (Withdrawal) Act 2018 (“UK Data Protection Law”); (iii) the EU e-Privacy Directive (Directive 2002/58/EC); and (iv) the Swiss Federal Act on Data Protection and its implementing regulations (“Swiss GDPR”), in each case as may be amended, superseded or replaced from time to time.

  + 8. Personal Data Breaches. To the extent permitted by law, regulation or governmental directive, Customer.io will notify Company without undue delay, but in any event within the time frame required by applicable Data Protection Law, of a Personal Data Breach affecting Personal Data Customer.io Processes in connection with the Services. Upon request, Customer.io will provide information to Company, to the extent known, about the Personal Data Breach to the extent necessary for Company to fulfill any obligations it has to investigate or notify authorities, except that Customer.io reserves the right to redact information that is confidential or competitively sensitive. Company agrees that email notification of a Personal Data Breach is sufficient and Company will notify Customer.io if it changes its contact information. Company agrees that Customer.io may not notify Company of security-related events that do not result in a Personal Data Breach or affect Personal Data Customer.io Processes in connection with the Services.

  + 9. Deletion and Return of Personal Data. Except to the extent required otherwise by Data Protection Law, upon termination or expiration of the Agreement, Customer.io will (at Company’s election) delete (after providing Company the ability to download, pursuant to the Agreement) all Company Data (including copies) in its possession or control in accordance with Customer.io’s retention and deletion policies.

  + 10. Compliance Verification. Upon reasonable written request, Customer.io will verify its compliance with this DPA by providing summary copies of independent audit reports or such other written responses to requests for information. Only to the extent Company cannot reasonably satisfy Customer.io’s compliance with this DPA through the exercise of its rights under this Section 10, or where required by applicable Data Protection Law or a regulatory authority, Company, or its authorized representatives, may conduct audits (including inspections) during the term of the Agreement to assess Customer.io’s compliance with the terms of this DPA. Any audit must (i) be conducted during Customer.io’s regular business hours, with reasonable advance notice of at least forty-five (45) calendar days; (ii) be subject to reasonable confidentiality controls, as determined by Customer.io; (iii) occur no more than once annually; (iv) restrict its findings to only data and information relevant to Company; and (v) obligate Company, to the extent permitted by law or regulation, to keep confidential any information disclosed that, by its nature, should be confidential.

  + 11. General. This DPA may not be modified except by a subsequent written instrument signed by the Parties. If any part of this DPA is held unenforceable, the validity of all remaining parts will not be affected. The term of this DPA is coterminous with the Agreement, except for obligations that survive past termination.

  + SCHEDULE 1: DESCRIPTION OF THE PROCESSING AND SUBPROCESSORS

  + SUBPROCESSORS

  + INFORMATION FOR INTERNATIONAL TRANSFERS

  + FREQUENCY OF TRANSFER

  + RETENTION PERIODS

  + STANDARD CONTRACTUAL CLAUSES

  + LOCALIZING THE STANDARD CONTRACTUAL CLAUSES

  + SCHEDULE 2: TECHNICAL AND ORGANIZATION SECURITY MEASURES

  + Customer.io implements the security measures described here: www.customer.io/legal/security

  − We provide the latest version of the Customer.io DPA for you to download here on this page. You can find additional information regarding Customer.io’s compliance with GDPR, U.S. State Data Privacy Laws, and more information about our security practices here. For your convienience we have included the newest Standard Contracutal Clauses (SCCs) within this document for co-execution.

  − Customer.io Data Processing Agreement 2023 Download

  − 2.11. “European Data Protection Law” means: (i) Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such data (General Data Protection Regulation) (“EU GDPR”); (ii) in respect of the United Kingdom the Data Protection Act 2018 and the EU GDPR as saved into United Kingdom law by virtue of Section 3 of the United Kingdom’s European Union (Withdrawal) Act 2018 (“UK Data Protection Law”); (iii) the EU e-Privacy Directive (Directive 2002/58/EC); and (iv) the Swiss Federal Act on Data Protection and its implementing regulations (“Swiss GDPR”), in each case as may be amended, superseded or replaced from time to time.

  − Schedule 1: Description of the Processing and Subprocessors

  − Subprocessors

  − Information for International Transfers

  − Frequency of Transfer

  − Retention Periods

  − Standard Contractual Clauses

  − Localizing the Standard Contractual Clauses

  − Schedule 2: Technical and Organization Security Measures

  − Customer.io implements the security measures described here: customer.io/legal/security
• low 2026-09-30 · privacy policy +1 / −1 lines
  show diff

  + Prior Privacy Policy versionsView earlier versions and the dates they were in effect.

  − Prior Privacy Policy documentsView earlier versions and the dates they were in effect.
• high 2026-09-29 · dpa +3 / −7 lines
  show diff

  + We provide the latest version of the Customer.io DPA for you to download here on this page. You can find additional information regarding Customer.io’s compliance with GDPR, U.S. State Data Privacy Laws, and more information about our security practices here. For your convienience we have included the newest Standard Contracutal Clauses (SCCs) within this document for co-execution.

  + Customer.io Data Processing Agreement 2023 Download

  + 2.11. “European Data Protection Law” means: (i) Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such data (General Data Protection Regulation) (“EU GDPR”); (ii) in respect of the United Kingdom the Data Protection Act 2018 and the EU GDPR as saved into United Kingdom law by virtue of Section 3 of the United Kingdom’s European Union (Withdrawal) Act 2018 (“UK Data Protection Law”); (iii) the EU e-Privacy Directive (Directive 2002/58/EC); and (iv) the Swiss Federal Act on Data Protection and its implementing regulations (“Swiss GDPR”), in each case as may be amended, superseded or replaced from time to time.

  − Effective September 2026

  − We provide the latest version of the Customer.io DPA for you to download here on this page. You can find additional information regarding Customer.io’s compliance with GDPR, U.S. State Data Privacy Laws, and more information about our security practices here. For your convenience we have included the newest Standard Contractual Clauses (SCCs) within this document for co-execution.

  − 2.11. “European Data Protection Law” means: (i) Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such data (General Data Protection Regulation) (“EU GDPR”); (ii) in respect of the United Kingdom, the Data Protection Act 2018 and the EU GDPR as saved into United Kingdom law by virtue of Section 3 of the United Kingdom’s European Union (Withdrawal) Act 2018 (“UK Data Protection Law”); (iii) the EU e-Privacy Directive (Directive 2002/58/EC); and (iv) the Swiss Federal Act on Data Protection and its implementing regulations (“Swiss GDPR”), in each case as may be amended, superseded or replaced from time to time.

  − 8. Personal Data Breaches. To the extent permitted by law, regulation or governmental directive, Customer.io will notify Company without undue delay, but in any event within the time frame required by applicable Data Protection Law, of a Personal Data Breach affecting Personal Data Customer.io Processes in connection with the Services. Upon request, Customer.io will provide information to Company, to the extent known, about the Personal Data Breach to the extent necessary for Company to fulfill any obligations it has to investigate or notify authorities, except that Customer.io reserves the right to redact information that is confidential or competitively sensitive. Company agrees that email notification of a Personal Data Breach is sufficient and Company will notify Customer.io if it changes its contact information. Company agrees that Customer.io may not notify Company of security-related events that do not result in a Personal Data Breach or affect Personal Data Customer.io Processes in connection with the Services.

  − 9. Deletion and Return of Personal Data. Except to the extent required otherwise by Data Protection Law, upon termination or expiration of the Agreement, Customer.io will (at Company’s election) delete (after providing Company the ability to download, pursuant to the Agreement) all Company Data (including copies) in its possession or control in accordance with Customer.io’s retention and deletion policies.

  − 10. Compliance Verification. Upon reasonable written request, Customer.io will verify its compliance with this DPA by providing summary copies of independent audit reports or such other written responses to requests for information. Only to the extent Company cannot reasonably satisfy Customer.io’s compliance with this DPA through the exercise of its rights under this Section 10, or where required by applicable Data Protection Law or a regulatory authority, Company, or its authorized representatives, may conduct audits (including inspections) during the term of the Agreement to assess Customer.io’s compliance with the terms of this DPA. Any audit must (i) be conducted during Customer.io’s regular business hours, with reasonable advance notice of at least forty-five (45) calendar days; (ii) be subject to reasonable confidentiality controls, as determined by Customer.io; (iii) occur no more than once annually; (iv) restrict its findings to only data and information relevant to Company; and (v) obligate Company, to the extent permitted by law or regulation, to keep confidential any information disclosed that, by its nature, should be confidential.

  − 11. General. This DPA may not be modified except by a subsequent written instrument signed by the Parties. If any part of this DPA is held unenforceable, the validity of all remaining parts will not be affected. The term of this DPA is coterminous with the Agreement, except for obligations that survive past termination.
• high 2026-09-29 · privacy policy +74 / −73 lines
  show diff

  + 1. Personal Information We Collect, Purpose for Processing & Categories of Third Parties Personal Information is Shared with

  + 2. How We Collect Personal Information

  + 3. How We Use Personal Information

  + 4. How We Share Personal Information

  + 5. European Privacy Rights

  + 6. U.S. Data Privacy Rights

  + 7. How We Protect Personal Information

  + 8. How Long We Retain Personal Information

  + 9. Your Choices

  + 10. Changes to this Privacy Policy

  + 11. Contact Us

  + 1. When you provide it to us, including when you complete forms, request information from us, or respond to our emails or otherwise communicate with us.

  + 2. Directly from our customers, including contact information, demographic information, device information, location-derived event data if a customer enables location-based features, SMS recipient data, message content, sender information, delivery events, inbound message activity, opt-out or preference data, business identifiers, campaign or use-case information, and any other information that our customers provide us in connection with their use of the Services.

  + 3. From service providers, including information about our customers and their employees, or about how our customers use our Services, the messages our customers send and how recipients interact with those messages.

  + 4. From third party business partners, including information about our customers and their employees, about how our customers use our Services or the messages our customers send, how recipients interact with those messages, or our own sales and marketing providers. These third parties include communications providers, third party messaging platforms that send or receive communications, third party analytics providers (e.g., Google Analytics), or third party social media providers (e.g., LinkedIn) or third party sales and marketing providers.

  + 5. Through automatic tracking technologies, including IP address, device ID or similar types of identifying information that we collect via cookies or other automatic tracking technologies. We also collect activities (links clicked, length of session, time/date, type of device, coarse geolocation) that we associate with IP address, device ID or other unique identifiers. We collect this information when you visit our Site, use our Services, or engage with our marketing materials. We also use automatic tracking technologies in the Services and to collect information about the messages our customers send. These automatic tracking technologies collect information about our customers’ end users, including how they interact with our customers’ messages, and whether they open or click links in any communication, and, where a customer enables location-based features, whether they entered or exited a customer-configured geofence.

  + 1. Details of your visit and your activity and information generated in the course of your interaction including, but not limited to, traffic data, location data (coarse geolocation), weblogs and other communication data, the resources that you access, and referring and exiting website.

  + 2. IP address and details regarding the device you use, including operating system, device ID, and browser type.

  + 3. Information about how you interact with our ads and newsletters or our customers messages, including whether you open communications or click links.

  + 4. Some customers may choose to use location-based features in the Services. When a customer enables these features, the customer is responsible for their configuration and use, and all notices, consents, and user choices required for the customer’s use of the features. Customer.io processes location-derived event data on behalf of the customer, such as whether an end user entered or exited a customer-configured geofence.

  + 1. Statistics Cookies: Statistic cookies help website owners to understand how visitors interact with websites by collecting and reporting information anonymously. We use these cookies to understand traffic to our Site and how visitors use our Site. This may include the number of visitors, the websites that referred them to our Site, the pages they visited on our Site, what time of day they visited, whether they have visited our Site before, and other similar information. We use this information to help operate and improve our Site and to monitor activity.

  + 2. Necessary Cookies: Necessary cookies help make a website usable by enabling basic functions like page navigation and access to secure areas of the website. The website cannot function properly without these cookies.

  + 3. Preference Cookies: Preference cookies enable a website to remember information that changes the way the website behaves or looks, like your preferred language or the region that you are in.

  + 4. Marketing Cookies: We use these cookies to remember your preferences, understand how visitors interact with our Site, and help us and our advertising partners show more relevant advertising. These cookies may track browsing activity across websites or apps and may use approximate location or other information made available by your browser or device to help show locale-specific content.

  + 1. Provide the Site, Services, and our content to you.

  + 2. For the purpose for which you provided it, to process your transactions or communicate with you.

  + 3. Provide you with information about products, services, offers, deals, or other information that is relevant to you.

  + 4. For research and development purposes, to study our products and services and to create new products and services.

  + 5. Administer, provide and communicate with you about contests, promotions and sweepstakes, upcoming events, or other news about products and services that we may offer.

  + 6. Provide you with information, products, or services that we believe will interest you.

  − * Personal Information We Collect, Purpose for Processing & Categories of Third Parties Personal Information is Shared with

  − * How We Collect Personal Information

  − * How We Use Personal Information

  − * How We Share Personal Information

  − * European Privacy Rights

  − * U.S. Data Privacy Rights

  − * How We Protect Personal Information

  − * How Long We Retain Personal Information

  − * Your Choices

  − * Changes to this Privacy Policy

  − * Contact Us

  − * When you provide it to us, including when you complete forms, request information from us, or respond to our emails or otherwise communicate with us.

  − * Directly from our customers, including contact information, demographic information, device information, location-derived event data if a customer enables location-based features, SMS recipient data, message content, sender information, delivery events, inbound message activity, opt-out or preference data, business identifiers, campaign or use-case information, and any other information that our customers provide us in connection with their use of the Services.

  − * From service providers, including information about our customers and their employees, or about how our customers use our Services, the messages our customers send and how recipients interact with those messages.

  − * From third party business partners, including information about our customers and their employees, about how our customers use our Services or the messages our customers send, how recipients interact with those messages, or our own sales and marketing providers. These third parties include communications providers, third party messaging platforms that send or receive communications, third party analytics providers (e.g., Google Analytics), or third party social media providers (e.g., LinkedIn) or third party sales and marketing providers.
• high 2026-09-26 · dpa +7 / −3 lines
  show diff

  + Effective September 2026

  + We provide the latest version of the Customer.io DPA for you to download here on this page. You can find additional information regarding Customer.io’s compliance with GDPR, U.S. State Data Privacy Laws, and more information about our security practices here. For your convenience we have included the newest Standard Contractual Clauses (SCCs) within this document for co-execution.

  + 2.11. “European Data Protection Law” means: (i) Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such data (General Data Protection Regulation) (“EU GDPR”); (ii) in respect of the United Kingdom, the Data Protection Act 2018 and the EU GDPR as saved into United Kingdom law by virtue of Section 3 of the United Kingdom’s European Union (Withdrawal) Act 2018 (“UK Data Protection Law”); (iii) the EU e-Privacy Directive (Directive 2002/58/EC); and (iv) the Swiss Federal Act on Data Protection and its implementing regulations (“Swiss GDPR”), in each case as may be amended, superseded or replaced from time to time.

  + 8. Personal Data Breaches. To the extent permitted by law, regulation or governmental directive, Customer.io will notify Company without undue delay, but in any event within the time frame required by applicable Data Protection Law, of a Personal Data Breach affecting Personal Data Customer.io Processes in connection with the Services. Upon request, Customer.io will provide information to Company, to the extent known, about the Personal Data Breach to the extent necessary for Company to fulfill any obligations it has to investigate or notify authorities, except that Customer.io reserves the right to redact information that is confidential or competitively sensitive. Company agrees that email notification of a Personal Data Breach is sufficient and Company will notify Customer.io if it changes its contact information. Company agrees that Customer.io may not notify Company of security-related events that do not result in a Personal Data Breach or affect Personal Data Customer.io Processes in connection with the Services.

  + 9. Deletion and Return of Personal Data. Except to the extent required otherwise by Data Protection Law, upon termination or expiration of the Agreement, Customer.io will (at Company’s election) delete (after providing Company the ability to download, pursuant to the Agreement) all Company Data (including copies) in its possession or control in accordance with Customer.io’s retention and deletion policies.

  + 10. Compliance Verification. Upon reasonable written request, Customer.io will verify its compliance with this DPA by providing summary copies of independent audit reports or such other written responses to requests for information. Only to the extent Company cannot reasonably satisfy Customer.io’s compliance with this DPA through the exercise of its rights under this Section 10, or where required by applicable Data Protection Law or a regulatory authority, Company, or its authorized representatives, may conduct audits (including inspections) during the term of the Agreement to assess Customer.io’s compliance with the terms of this DPA. Any audit must (i) be conducted during Customer.io’s regular business hours, with reasonable advance notice of at least forty-five (45) calendar days; (ii) be subject to reasonable confidentiality controls, as determined by Customer.io; (iii) occur no more than once annually; (iv) restrict its findings to only data and information relevant to Company; and (v) obligate Company, to the extent permitted by law or regulation, to keep confidential any information disclosed that, by its nature, should be confidential.

  + 11. General. This DPA may not be modified except by a subsequent written instrument signed by the Parties. If any part of this DPA is held unenforceable, the validity of all remaining parts will not be affected. The term of this DPA is coterminous with the Agreement, except for obligations that survive past termination.

  − We provide the latest version of the Customer.io DPA for you to download here on this page. You can find additional information regarding Customer.io’s compliance with GDPR, U.S. State Data Privacy Laws, and more information about our security practices here. For your convienience we have included the newest Standard Contracutal Clauses (SCCs) within this document for co-execution.

  − Customer.io Data Processing Agreement 2023 Download

  − 2.11. “European Data Protection Law” means: (i) Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such data (General Data Protection Regulation) (“EU GDPR”); (ii) in respect of the United Kingdom the Data Protection Act 2018 and the EU GDPR as saved into United Kingdom law by virtue of Section 3 of the United Kingdom’s European Union (Withdrawal) Act 2018 (“UK Data Protection Law”); (iii) the EU e-Privacy Directive (Directive 2002/58/EC); and (iv) the Swiss Federal Act on Data Protection and its implementing regulations (“Swiss GDPR”), in each case as may be amended, superseded or replaced from time to time.

Fact changes

• medium 2026-09-29 · 1 field change(s), +0/−0 subprocessors, +0 model providers

Corrections

No correction requests. Anyone may dispute a fact with a source; requests and resolutions are public and ledger-entered.