Intercom

Downstream

Who's behind Intercom, as listed in its own subprocessor documents. 1 subprocessor.

Reviewer notes

Extracted by deterministic rules (rules/v1), no language model. Coverage is limited to recognisable clauses and a gazetteer of common subprocessors; absent values mean 'not matched', not 'not present'. training-adjacent sentence found but not classifiable by rules

Documents read

• privacy policy https://www.intercom.com/legal/privacyHTTP 200 · 2026-10-22
• dpa https://www.intercom.com/legal/data-processing-agreementHTTP 200 · 2026-10-22

Document changes

• high 2026-10-22 · dpa +151 / −106 lines
  show diff

  + Effective November 4, 2026

  + This Data Processing Addendum, including its annexes and the Standard Contractual Clauses, ("DPA") is made by and between Intercom (“Intercom”)1, and Customer, pursuant to the Master SaaS Subscription Agreement, the Intercom Terms of Service or other written or electronic agreement between the parties (as applicable) ("Agreement").

  + i."Account Data" means Personal Data that relates to Customer’s relationship with Intercom. This includes information used for Customer’s account and billing management, identity verification, investigating and preventing system abuse, or fulfilling Intercom’s legal obligations.

  + iii."Applicable Data Protection Legislation" refers to laws and regulations applicable to Intercom’s processing of personal data under the Agreement, including but not limited to (a) the GDPR, (b) in respect of the UK, the GDPR as saved into United Kingdom law by virtue of section 3 of the United Kingdom's European Union (Withdrawal) Act 2018 ("UK GDPR") and the Data Protection Act 2018 (together, "UK Data Protection Laws"), (c) the Swiss Federal Data Protection Act and its implementing regulations ("Swiss DPA"), (d) the CCPA & CPRA, (e) the Australian Privacy Laws; (f) the LGPD; and (g) PIPEDA; in each case, as may be amended, superseded or replaced.

  + iv."APPs" means the 13 Australian Privacy Principles set out in Schedule 1 of the Privacy Act 1988 of Australia.

  + v."Australian Privacy Laws" means the Privacy Act 1988 of Australia, as amended, including the Australian Privacy Principles contained therein.

  + vi."CCPA" or "CCPA and CPRA" means the California Consumer Privacy Act of 2018 and any binding regulations promulgated thereunder, in each case, as may be amended from time to time. This includes but it is not limited to the California Privacy Rights Act of 2020.

  + vii."Controller" or "controller" means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of Personal Data. It shall have the same meaning ascribed to “controller” under the GDPR and other equivalent terms under Applicable Data Protection Legislation (e.g., ”Business” as defined under the CCPA), as applicable.

  + viii."Customer Data" has the meaning set forth in the Agreement.

  + ix.“Customer Personal Data” means Personal Data that Intercom processes as a Processor on behalf of Customer in order to provide the Services under the Agreement.

  + x."Europe" means for the purposes of this DPA the European Economic Area ("EEA"), the United Kingdom ("UK") and Switzerland, or another country which ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of Personal Data, as determined by the European Commission in the case that EU Data Protection Law applies respectively as determined by the ICO in the case that UK Data Protection Law applies.

  + xi."GDPR" means Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).

  + xii.“LGPD” means Law No. 13,709/2018 (Lei Geral de Proteção de Dados), Brazil's General Data Protection Law.

  + xiii."Personal Data" or "personal data" or "personal information" means any information, including personal information, relating to an identified or identifiable natural person (“data subject”) or as defined in and subject to Applicable Data Protection Legislation.

  + xiv."PIPEDA" means Canada’s Personal Information Protection and Electronic Documents Act (S.C. 2000, c 5).

  + xv.“Privacy Policy” means the current privacy policy for the Services available at https://www.intercom.com/legal/privacy.

  + xvi."Processor" or "processor" means the entity which processes Personal Data on behalf of the Controller. It shall have the meaning ascribed to “processor” under the GDPR and other equivalent terms under other Applicable Data Protection Legislation (e.g., “Service Provider” as defined under the CCPA), as applicable.

  + xvii."Processing" or "processing" (and "Process" or "process") means any operation or set of operations performed upon Personal Data, whether or not by automated means, such as collection, recording, securing, organization, storage, adaptation or alteration, access to, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure, or destruction.

  + xviii."Restricted Transfer" means: (i) where the GDPR applies, a transfer of personal data from the EEA to a country outside of the EEA which is not subject to an adequacy determination by the European Commission; (ii) where the UK GDPR applies, a transfer of personal data from the UK to any other country which is not based on an adequacy regulation by the UK government; (iii) where the Swiss DPA applies, a transfer of personal data to a country outside of Switzerland which is not included on the list of adequate jurisdictions published by the Swiss Federal Data Protection and Information Commissioner and (iv) where the LGPD applies, a transfer of personal data to a country outside of Brazil which is not included on the list of adequate jurisdictions published by the Brazilian Data Protection Authority; (v) where the Australian Privacy Laws apply, a cross-border disclosure of Personal Data to an overseas recipient in a country outside of Australia where the recipient is not subject to a law or binding scheme that provides substantially similar protection to the APPs; (vi) where PIPEDA applies, a transfer from Canada to a country outside of Canada.

  + xix."Security Breach" means a breach of security leading to any accidental, unauthorized or unlawful loss, disclosure, destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data transmitted, stored or otherwise processed by Intercom. For the avoidance of doubt, a Security Breach shall not include an unsuccessful attempt or activity that does not compromise the security of Customer Personal Data, including (without limitation) pings and other broadcast attacks of firewalls or edge servers, port scans, unsuccessful log-on attempts, denial of service attacks, packet sniffing (or other unauthorized access to traffic data that does not result in access beyond headers) or similar incidents.

  + xx."Standard Contractual Clauses" or "SCCs" means (i) where the GDPR applies, the standard contractual clauses annexed to the European Commission's Implementing Decision (EU) 2021/914 of 4 June 2021 standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, available at

  + https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32021D0914&from=EN ("EU SCCs"); (ii) where the UK GDPR applies, the applicable standard data protection clauses adopted pursuant to Article 46(2)(c) or (d) of the UK GDPR, including the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the Information Commissioner's Office under s.119A(1) of the Data Protection Act 2018, as such Addendum may be revised under Section 18 therein ("UK SCCs"); (iii) where the Swiss DPA applies, the applicable standard data protection clauses issued, approved or recognized by the Swiss Federal Data Protection and Information Commissioner (the "Swiss SCCs"); and (iv) where the LGPD applies, the applicable standard protection clauses issued, approved or recognized by the Brazilian data protection authority (the “Brazil SCCs”), (in each case, as updated, amended or superseded from time to time).

  + xxi."Sub-processor" or "sub-processor" means (a) Intercom, when Intercom is processing Customer Personal Data and where Customer is itself a processor of such Customer Personal Data, or (b) any third-party Processor engaged by Intercom or its Affiliates to assist in fulfilling Intercom's obligations under the Agreement and which processes Customer Personal Data. Sub-processors may include third parties or Intercom Affiliates but shall exclude Intercom employees, contractors or consultants.

  + xxii."Third Party Request" means any request, correspondence, inquiry, or complaint from a data subject, regulatory authority, or third party.

  + xxiii."UK Addendum" means the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the Information Commissioner's Office under s.119A(1) of the Data Protection Act 2018, as such Addendum may be revised under Section 18 therein. This is found in Schedule 4 below.

  + iii.Intercom as a Processor. The parties acknowledge and agree that regarding the processing of Customer Personal Data, Customer may act either as a controller or processor and Intercom is a processor. Intercom will only process Customer Personal Data in accordance with Customer’s documented instructions as set forth in Section 3 (Customer Instructions).

  + iv.Intercom as a Controller of Account Data. The parties acknowledge that, regarding the processing of Account Data, Customer is a controller and Intercom is an independent controller, not a joint controller with Customer. Intercom will process Account Data as a controller (a) in order to manage the relationship with Customer; (b) carry out Intercom’s core business operations; (c) in order to detect, prevent, or investigate security incidents, fraud, and other abuse or misuse of the Services; (d) identity verification; (e) to comply with Intercom’s legal or regulatory obligations; and (f) as otherwise permitted under Applicable Data Protection Legislation and in accordance with Intercom’s Privacy Policy.

  + Customer shall be responsible for ensuring that: (a) all such notices have been given, and all such authorizations have been obtained, as required under Applicable Data Protection Legislation, for Intercom (and its Affiliates and Sub-processors) to process Customer Personal Data as contemplated by the Agreement and this DPA; (b) it has complied, and will continue to comply, with all applicable laws relating to privacy and data protection, including Applicable Data Protection Legislation; and (c) it has, and will continue to have, the right to transfer, or provide access to, Customer Personal Data to Intercom for processing in accordance with the terms of the Agreement and this DPA.

  + i.Authorization for Sub-processing. Customer agrees that (a) Intercom may engage Sub-processors as listed at https://www.intercom.com/legal/subprocessors-list/update (the "Sub-processor Page") which may be updated from time to time and Intercom Affiliates; and (b) such Affiliates and Sub-processors respectively may engage third party processors to process Customer Personal Data on Intercom's behalf. Customer provides a general authorization for Intercom to engage additional third-party Sub-processors to process Customer Personal Data in accordance with the Agreement that is conditioned on the following requirements: (a) Intercom will restrict the onward Sub-processor’s access to Customer Personal Data only to what is strictly necessary to provide the Services and in accordance with the Agreement, and Intercom will prohibit the sub-processor from processing the Customer Personal Data for any other purpose. (b) Intercom agrees to impose contractual data protection obligations, including appropriate technical and organizational measures to protect personal data, on any sub-processor it appoints that require such sub-processor to protect Customer Personal Data to the standard required by Applicable Data Protection Legislation; and (c) Intercom will remain liable and accountable for any breach of this DPA that is caused by an act or omission of its sub-processors.

  + a.Customer understands that effective operation of the Services may require the transfer of Customer Personal Data to Intercom Affiliates, such as Intercom, Inc., or to Intercom's Sub-processors, see Schedule 3. Customer hereby authorizes the transfer of Customer Personal Data to locations outside Europe (Intercom’s primary processing facilities are in the United States of America), including to Intercom Affiliates and Sub-processors, subject to continued compliance with this DPA throughout the duration of the Agreement.

  − Effective April 9, 2025

  − This Data Processing Addendum, including its annexes and the Standard Contractual Clauses, ("DPA") is made by and between Intercom (“Intercom”), and Customer, pursuant to the Master SaaS Subscription Agreement, the Intercom Terms of Service or other written or electronic agreement between the parties (as applicable) ("Agreement").

  − i."Account Data" means Personal Data that relates to Customer’s relationship with Intercom, including to access Customer’s account and billing information, identity verification, maintain or improve performance of the Services, provide support, investigate and prevent system abuse, or fulfill legal obligations.

  − iii."Applicable Data Protection Legislation" refers to laws and regulations applicable to Intercom’s processing of personal data under the Agreement, including but not limited to (a) the GDPR, (b) in respect of the UK, the GDPR as saved into United Kingdom law by virtue of section 3 of the United Kingdom's European Union (Withdrawal) Act 2019 ("UK GDPR") and the Data Protection Act 2018 (together, "UK Data Protection Laws"), (c) the Swiss Federal Data Protection Act and its implementing regulations ("Swiss DPA"), (d) CCPA & CPRA, and (e) Australian Privacy Principles and the Australian Privacy Act (1988), in each case, as may be amended, superseded or replaced.

  − iv."CCPA" or "CCPA and CPRA" means the California Consumer Privacy Act of 2018 and any binding regulations promulgated thereunder, in each case, as may be amended from time to time. This includes but it is not limited to the California Privacy Rights Act of 2020.

  − v."Controller" or "controller" means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of Personal Data. It shall have the same meaning ascribed to “controller” under the GDPR and other equivalent terms under Applicable Data Protection Legislation (e.g., ”Business” as defined under the CCPA), as applicable.

  − vi."Customer Data" has the meaning set forth in the Agreement.

  − vii.“Customer Personal Data” means Personal Data that Intercom processes as a Processor on behalf of Customer.

  − viii."Europe" means for the purposes of this DPA the European Economic Area ("EEA"), the United Kingdom ("UK") and Switzerland, or another country which ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of Personal Data, as determined by the European Commission in the case that EU Data Protection Law applies respectively as determined by the ICO in the case that UK Data Protection Law applies.

  − ix."GDPR" means Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).

  − x."Personal Data" or "personal data" or "personal information" means any information, including personal information, relating to an identified or identifiable natural person (“data subject”) or as defined in and subject to Applicable Data Protection Legislation.

  − xi.“Privacy Policy” means the current privacy policy for the Services available at https://www.intercom.com/legal/privacy.

  − xii."Processor" or "processor" means the entity which processes Personal Data on behalf of the Controller. It shall have the meaning ascribed to “processor” under the GDPR and other equivalent terms under other Applicable Data Protection Legislation (e.g., “Service Provider” as defined under the CCPA), as applicable.

  − xiii."Processing" or "processing" (and "Process" or "process") means any operation or set of operations performed upon Personal Data, whether or not by automated means, such as collection, recording, securing, organization, storage, adaptation or alteration, access to, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure, or destruction.

  − xiv."Restricted Transfer" means: (i) where the GDPR applies, a transfer of personal data from the EEA to a country outside of the EEA which is not subject to an adequacy determination by the European Commission; (ii) where the UK GDPR applies, a transfer of personal data from the UK to any other country which is not based on adequacy regulations pursuant to Section 17A of the Data Protection Act 2018; and (iii) where the Swiss DPA applies, a transfer of personal data to a country outside of Switzerland which is not included on the list of adequate jurisdictions published by the Swiss Federal Data Protection and Information Commissioner.
• high 2026-10-22 · privacy policy +13 / −8 lines
  show diff

  + Effective October 21, 2026

  + (prior version of the Privacy Policy available to view here)

  + 1.2When we refer to Intercom, we mean Intercom R&D Unlimited Company, a company registered in Ireland with offices at 124 St Stephen's Green, Dublin 2, DC02 C628; Intercom, Inc. a Delaware corporation with offices at 55 2nd Street, 4th Fl., San Francisco, CA 94105, USA; Intercom Software UK Limited, a private limited company registered in the United Kingdom ("UK") with offices at Level 9, the Warehouse 207-211 Old St, London, EC1V 9NR UK; Intercom Software Australia Pty Ltd, a company registered in Australia with offices at 285A Crown St. Surry Hills NSW 2010, Australia, 1st Floor, Sydney; Intercom R&D GmbH, a company registered in Germany with offices at Zimmerstraße 78 10117 Berlin, and Intercom's group companies ("Intercom", "we", "us", "our")1.

  + The below Privacy Policy does not apply to the extent we process data as a processor or service provider on behalf of an Intercom customer.

  + 2.3NON-USER DATA

  + We use publicly available online information as part of our AI model training. We do not intentionally collect personal information, but it is possible that we incidentally collect personal information as part of the publicly available online information. We take steps to remove personal information prior to AI model training. For more information on AI Model Training see here.

  + Consultants and vendors engaged by us to support our provision of the Intercom Services and Sites and the operation of our business (for services such as hosting, information technology and software, customer support, sales support and lead qualification and outreach, email and telephone communications, call recording, marketing, advertising, payment processing, user authentication, market/survey research, data brokerage, generative artificial intelligence, and analytics).

  + Law enforcement, including government agencies, law enforcement authorities, and judicial authorities in order to:

  + 6.6In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Intercom, Inc. commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities, the UK Information Commissioner's Office, the Gibraltar Regulatory Authority and the Swiss Federal Data Protection and Information Commissioner with regard to unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF. Under certain conditions, it may be possible to invoke binding arbitration for complaints regarding DPF compliance not resolved by any of the other DPF mechanisms, see here for additional information.

  + The Federal Trade Commission has jurisdiction over Intercom, Inc.'s compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF.

  + * Authorities and other legal and governmental bodies

  + ----------------------------------------

  + 1 For purposes of this Policy, Intercom is used in order to reflect the legal name of the contracting entity, but any references to Intercom should be interpreted as referring to Fin as one and the same. ↩

  − Effective August 21, 2026

  − 1.2When we refer to Intercom, we mean Intercom R&D Unlimited Company, a company registered in Ireland with offices at 124 St Stephen's Green, Dublin 2, DC02 C628; Intercom, Inc. a Delaware corporation with offices at 55 2nd Street, 4th Fl., San Francisco, CA 94105, USA; Intercom Software UK Limited, a private limited company registered in the United Kingdom ("UK") with offices at Level 9, the Warehouse 207-211 Old St, London, EC1V 9NR UK; Intercom Software Australia Pty Ltd, a company registered in Australia with offices at 285A Crown St. Surry Hills NSW 2010, Australia, 1st Floor, Sydney; Intercom R&D GmbH, a company registered in Germany with offices at Zimmerstraße 78 10117 Berlin, and Intercom's group companies ("Intercom", "we", "us", "our").

  − * the size of your company;

  − Consultants and vendors engaged by us to support our provision of the Intercom Services and Sites and the operation of our business (for services such as hosting, information technology and software, customer support, email and telephone communications, call recording, marketing, advertising, payment processing, user authentication, market/survey research, data brokerage, generative artificial intelligence, and analytics).

  − 5.3Some personal data is held on your own device rather than on our systems, using cookies and browser web storage. This includes details you have entered into our forms, which we save so that we can prefill them for you. We keep those details for no more than 14 days. You can remove them at any time using your cookie settings, or by clearing cookies and browser web storage in your browser settings. Our Cookie Policy explains these technologies and your choices in more detail.

  − 6.6In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Intercom, Inc. commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities ("DPAs"), the UK Information Commissioner's Office (ICO), the Gibraltar Regulatory Authority ("GRA") and the Swiss Federal Data Protection and Information Commissioner ("FDPIC") with regard to unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF. Under certain conditions, it may be possible to invoke binding arbitration for complaints regarding DPF compliance not resolved by any of the other DPF mechanisms, see here for additional information.

  − The Federal Trade Commission has jurisdiction over Intercom, Inc.'s compliance with the EU-U.S. Data Privacy Framework EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF.

  − * Authorities and others
• low 2026-10-17 · dpa +1 / −1 lines
  show diff

  + Terms of ServiceIntercom Additional Product TermsPrivacy PolicyData Processing AddendumProduct Privacy NoticeIntercom Regional Data Hosting AddendumSupport PolicyDeployment Services TermsCookie PolicySubprocessors ListData Privacy Framework NoticeIntercom Website Terms of UseAcademy TermsService Level AgreementAcceptable Use PolicyCode of ConductTrademark UsageIntercom Global Anti-Corruption StatementIntercom Partner Code of ConductIntercom DMCA PolicyLaw Enforcement GuidelinesEuropean Digital Services Act NoticeEU Data Act Addendum Referral ProgramPartner OfferIntercom Podcast OfferPromotional Offer Terms

  − Terms of ServiceIntercom Additional Product TermsPrivacy PolicyData Processing AddendumProduct Privacy NoticeIntercom Regional Data Hosting AddendumSupport PolicyDeployment Services TermsCookie PolicySubprocessors ListData Privacy Framework NoticeIntercom Website Terms of UseAcademy TermsService Level AgreementAcceptable Use PolicyCode of ConductTrademark UsageIntercom Global Anti-Corruption StatementIntercom Partner Code of ConductIntercom DMCA PolicyLaw Enforcement GuidelinesEuropean Digital Services Act NoticeEU Data Act Addendum Fin GuaranteeReferral ProgramPartner OfferIntercom Podcast OfferPromotional Offer Terms
• low 2026-10-17 · privacy policy +1 / −1 lines
  show diff

  + Terms of ServiceIntercom Additional Product TermsPrivacy PolicyData Processing AddendumProduct Privacy NoticeIntercom Regional Data Hosting AddendumSupport PolicyDeployment Services TermsCookie PolicySubprocessors ListData Privacy Framework NoticeIntercom Website Terms of UseAcademy TermsService Level AgreementAcceptable Use PolicyCode of ConductTrademark UsageIntercom Global Anti-Corruption StatementIntercom Partner Code of ConductIntercom DMCA PolicyLaw Enforcement GuidelinesEuropean Digital Services Act NoticeEU Data Act Addendum Referral ProgramPartner OfferIntercom Podcast OfferPromotional Offer Terms

  − Terms of ServiceIntercom Additional Product TermsPrivacy PolicyData Processing AddendumProduct Privacy NoticeIntercom Regional Data Hosting AddendumSupport PolicyDeployment Services TermsCookie PolicySubprocessors ListData Privacy Framework NoticeIntercom Website Terms of UseAcademy TermsService Level AgreementAcceptable Use PolicyCode of ConductTrademark UsageIntercom Global Anti-Corruption StatementIntercom Partner Code of ConductIntercom DMCA PolicyLaw Enforcement GuidelinesEuropean Digital Services Act NoticeEU Data Act Addendum Fin GuaranteeReferral ProgramPartner OfferIntercom Podcast OfferPromotional Offer Terms
• low 2026-10-13 · dpa +1 / −2 lines
  show diff

  + Fin AI Agent

  − Fin AI Agent→

  − Print this page
• low 2026-10-13 · privacy policy +1 / −2 lines
  show diff

  + Fin AI Agent

  − Fin AI Agent→

  − Print this page
• low 2026-09-29 · dpa +1 / −1 lines
  show diff

  + Terms & Policies

  − TERMS & POLICIES
• low 2026-09-29 · privacy policy +1 / −1 lines
  show diff

  + Terms & Policies

  − TERMS & POLICIES
• high 2026-09-06 · dpa +3 / −3 lines
  show diff

  + * https://www.intercom.

  + * Customer Personal Data is encrypted at rest using 256-bit encryption, leveraging AWS’ encryption framework’s model C as described in https://d0.awsstatic..pdf

  + * See https://www.intercom..

  − * https://www.intercom.com/help/en/articles/1385437-how-intercom-complies-with-gdpr

  − * Customer Personal Data is encrypted at rest using 256-bit encryption, leveraging AWS’ encryption framework’s model C as described in https://d0.awsstatic.com/whitepapers/aws-securing-data-at-rest-with-encryption.pdf

  − * See https://www.intercom.com/help/en/articles/4667982-review-actions-taken-in-your-workspace-with-teammate-activity-logs.

Fact changes

• medium 2026-09-05 · 1 field change(s), +1/−0 subprocessors, +0 model providers

Corrections

No correction requests. Anyone may dispute a fact with a source; requests and resolutions are public and ledger-entered.