Microsoft, Microsoft 365, Outlook, SharePoint, OneDrive, Microsoft Teams, Microsoft Graph, Azure, and Entra are trademarks of the Microsoft group of companies. ImpressionsDirect360 is an independent provider and is not affiliated with, sponsored by, or endorsed by Microsoft.
These are the vendors that can process customer data on our behalf — your account, your Microsoft tenant content, and anything the product handles for you. The list is complete as of the review date: if a vendor is not on it, your customer data does not reach it.
Separately, and named here for completeness: our site loads Google AdSense and the TikTok advertising pixel, on signed-in pages as well as public ones. They receive ordinary web analytics — which pages are visited, and device and browser information — plus, on the pricing and sign-up pages, an event recording that a plan was viewed or an account created. Our servers additionally report checkout and purchase events to TikTok, carrying the amount and your contact details hashed with SHA-256; the privacy policy sets that out in full. They do not receive your Microsoft 365 mail, files, or calendar, which is why they are not subprocessors of customer data and are not listed below.
Until August 23, 2026 the TikTok pixel was also sent the email address, phone number and account id of every signed-in visitor, in plain text and without asking. That was wrong, it was never disclosed here, and it has been removed. If we ever reinstate that kind of matching it will be hashed, behind a real consent choice, and written on this page before it ships.
Last reviewed August 22, 2026
| Subprocessor | Purpose | Data categories | Processing region | More |
|---|---|---|---|---|
| Microsoft | Your Microsoft 365 tenant is the system of record for managed customers: Outlook, OneDrive, SharePoint, and Teams. Our automations reach it through Microsoft Graph, and the automation logic itself runs on Azure Functions and Logic Apps. |
| Your tenant's own Microsoft region, chosen by you at sign-up; our Azure automation resources run in the United States. | microsoft.com |
| Google Cloud / Firebase | Runs the ID360 Studio application: Firebase Authentication for sign-in, Cloud Firestore for the application database, and Firebase hosting and functions for platform services. |
| United States | cloud.google.com |
| Vercel | Hosts and serves the impressionsdirect360.com web application and its API routes. |
| United States (primary deployment region), with a global edge network for static assets. | vercel.com |
| Stripe | Processes all card payments and subscription billing. Card details are entered directly into Stripe and are never sent to, or stored on, our servers. |
| United States | stripe.com |
| Resend | Delivers transactional email — sign-in and verification messages, receipts, support replies, and automation notifications. |
| United States | resend.com |
| Google (Gemini API) | Runs the model calls behind ID360 AI and the Studio's AI tools — the assistant, the website builder, the logo maker, and content generation. Prompt content is sent to Google's Gemini API for processing and the response is returned to us; we do not retain it outside your own records. |
| United States | ai.google.dev |
| Self-hosted inference provider (not currently in use) | A second inference path exists in the codebase for open-weight models, restricted by a hard-coded allowlist of US-hosted providers. It is not what serves any shipping feature today — Google's Gemini API is. Listed here so the allowlist below is not mistaken for a description of the live path. |
| United States | Details |
ID360 AI does not run on one fixed vendor. The endpoint is resolved from configuration at runtime and checked against an allowlist of US-hosted providers held in code. Anything not on the list is refused outright in production — including a mirror, a proxy, or a raw IP address, which a list of banned names would miss. The approved hosts are:
*.services.ai.azure.comapi.deepinfra.comapi.together.xyzapi.fireworks.aiYour content is sent to whichever of these is configured, for the duration of the request, and is not used to train models.
Adding a subprocessor means changing this page and the review date on it. If you are a managed customer and want to be told directly before a new subprocessor starts handling your data, ask us at legal@impressionsdirect360.com and we will add you to the notice list. We would rather keep a short list of people to email than promise a mechanism we have not built.
Listing a vendor here is not a statement about their certifications or ours. We hold no security certification of our own — see what we do and do not claim.