Subprocessors
Last updated: October 24, 2026
Running SMG Tools means other companies handle some of your data on our behalf — sending your emails, taking your payments, storing your files. Below is every one of them, what it receives, and why. Each links to its own privacy terms.
This list is built from what the software actually calls, not from what we remember signing up for. If a service appears in our code but never receives customer data, it is not on this list, because padding it would make the real entries harder to judge.
A service you connect your own account to and choose to send your records to is not on it either. The QuickBooks Online company or Xero organization a business connects for the accounting sync receives that business’s records as its own destination, under its own agreement with Intuit or Xero, and does nothing for us. What is sent to it is in section 4.19 of the Privacy Policy. The same is true of the Thumbtack account a business connects: it receives that business’s replies, statuses and numbers as its own destination, under its own agreement with Thumbtack. What is sent to it is in section 4.24.
Microsoft Azure United States
| Service | What it does | What it receives |
|---|---|---|
| App Service, PostgreSQL & Blob Storage | Runs SMG Tools and stores its database and files | Everything you enter into SMG Tools, plus uploaded logos, job photos, receipts, signed PDFs, the documents a business keeps on its clients, and — where a business switches arrival location capture on — the coordinates a field worker’s phone reports when they mark themselves arrived |
| Communication Services (Email) | Sends quotes, invoices and reminders to your clients, and purchase orders to your suppliers | Recipient email addresses and the contents of the messages we send on your behalf |
| Azure OpenAI | Drafts proposal content and suggests line items and the lines of a proposal’s options when you ask it to, transcribes and interprets what you say to the voice assistant, understands what a caller says to the assistant answering your telephone, reads your own website to propose your setup, writes the summary over figures your own reports computed when you ask how the business did or switch on the monthly summary, builds a report from your description and explains a report in a paragraph when you ask it to, writes the short answer over our own published help pages when you ask how something is done, drafts a job’s materials list from the parts you stock when you ask it to, drafts a proposal’s lines from what was measured at its site when you ask it to, drafts a payment reminder from an unpaid invoice when you ask it to, drafts a calculator from your description or works out its rules from a parts list’s assumptions when you ask it to, and drafts the follow-up on a quote that has gone quiet when you open it to follow up, and, where a business turns on Drafted for you, drafts a quote for each new request, reads a site walk’s photos to draft one from them, and draws what the finished work could look like from one of them when asked | The job description and proposal text you send for drafting; a proposal’s lines, your Price Book’s items and prices, and your labor rates, when you ask it to suggest lines; voice recordings, which are transcribed and not retained; your own client names and job titles, sent so spoken names are recognized correctly; the readable text of your own website, when you ask us to set your business up from it; when you ask how the business did, the totals your own reports worked out — never a job, client, invoice or expense record; when you describe a report, your words and the records and fields your role can build one from, by name and meaning — never a value; when you ask it to explain a report, the report as you see it, its groups and their figures — never a record; when you ask it to draft a job’s materials list, the job’s title, description and kind of work and the lines it was sold with, the names of the parts you stock, and the titles of your similar jobs with the parts each used — never a cost or a client record; when you ask it to draft a proposal’s lines from a site, the proposal’s title and description, the site’s address, the names and sizes of what was measured there, and your Price Book’s items by name, unit and what each is measured by — never a price or a cost; when you ask it to draft a payment reminder, your business’s name, the client’s first name, the invoice’s number, what it was for, what is owed, its total, its due date and how late it is, and whether the client usually pays on time or is slow — never their contact details or other records; when you ask it to draft a calculator or work out its rules, what you typed, your trade, your Price Book’s items by name, kind and unit, a few ready-made calculators and one of your own as examples, and the calculator’s lines by item, unit and quantity — never a price, a cost, a client or a site; and, when you ask how something is done, your question and the text of our own public help pages, which is not your data at all; where a business turns on Drafted for you, a new request’s words, or a site walk’s photos and what was said about the work, with your Price Book’s items, kinds of work, calculators and what is measured at the place, by name, and your business’s city and state; and, for a picture of the finished work, one of the walk’s photos with the draft’s description of the work and your trade — never a price, a cost or the requester’s contact details. Not used to train models |
| Document Intelligence | Reads receipts you photograph so expenses fill themselves in, and — on Professional — the supplier bills you photograph or upload, so their lines are matched to your orders | The receipt images and supplier bills (photos or PDFs) you upload |
| Service Bus | Carries background work between parts of the system | Event details in transit — appointment reminders, notification triggers |
| Application Insights | Tells us when something is broken or slow | Request paths, timings, error details and IP addresses. Not the contents of your records |
| Microsoft account sign-in | Lets you sign in with a Microsoft account, if you choose to | Your name and email address, only when you use this sign-in method |
| Browser notifications (Edge on Windows) | Delivers a notification to a computer whose Edge browser a person turned notifications on for | An encrypted notification it cannot read, the address its browser was given for this site, and when it was sent. The notification itself says what happened, who and on which job — never a note’s words, an amount or an address |
| Defender for Storage, with Event Grid | Scans the photos and documents clients send a business for malware before anyone at the business can open them, and tells SMG Tools what it found | Each file a client sends, read within the same Azure region and not kept; the file’s address in storage and the scan’s result. In limited cases a file’s fingerprint (its SHA-256 hash) is shared with Microsoft’s own threat protection |
Twilio United States
| Service | What it does | What it receives |
|---|---|---|
| Phone numbers and calls | Leases each business its own telephone number, carries the calls its assistant picks up, and turns the caller’s speech into text and the assistant’s replies into speech while the call is in progress | The caller's number, the number dialed, the call audio while the call is in progress, and the words each side said, which come back to us as text. No audio is recorded or retained by us |
| Text messages | Sends a business’s texts to its customers from the business’s own number, and SMG Tools’ verification codes from ours; brings back the replies, STOP and HELP, and whether each text was delivered | Recipient phone numbers, message text, and the replies customers send |
| Toll-free number verification | Registers a business’s number with the phone carriers, which they require before they deliver its texts | The business’s legal name, trading name, address, website, its contact’s name, email and phone, sample messages and how its customers agree to texts, and its EIN — passed through for the carriers’ check and never kept by SMG Tools |
Google United States
| Service | What it does | What it receives |
|---|---|---|
| Maps & Places | Address autocomplete, service areas, drive-distance estimates, route computation — the drive between a planned day’s stops, the order to drive them, the drive to an address being booked into a planned day, and each person’s drive to work the office is placing — finding your own business listing when you ask us to set up from your website, and measuring a site: satellite imagery and Street View, the roof data of a building, and the picture of a site on a proposal | Addresses you type or select, and those your customers type on your public booking page and request form where you offer suggestions; job site locations, the addresses of a planned day’s stops, and where each person’s day starts. Your business name and locality when we look for your listing, which we use only if the website Google holds for it is the one you gave us. A site’s address, the point clicked on a building for its roof, and the shapes traced at a site when its picture is drawn — the picture is not stored. Never a device’s location, and never who a person is |
| Weather | Shows conditions at a job site, and the forecast for each visit’s hours where you add Weather | Job site coordinates; for a forecast, the point of each place your visits are, rounded to about a kilometer — never a name, an address or what the visit is |
| reCAPTCHA | Stops bots submitting your public inquiry form | Visitor IP address and browser signals on public pages only |
| Analytics | Shows us how the site is used, and which of our ads lead to sign-ups — that part shared with Google Ads | Site usage and IP address, and that an account was created and whether by email or a Google or Microsoft sign-in — only if a visitor accepts analytics cookies |
| Google account sign-in | Lets you sign in with a Google account, if you choose to | Your name and email address, only when you use this sign-in method |
| Browser notifications (Chrome and Android) | Delivers a notification to a phone or computer whose Chrome or Android browser a person turned notifications on for | An encrypted notification it cannot read, the address its browser was given for this site, and when it was sent. The notification itself says what happened, who and on which job — never a note’s words, an amount or an address |
Apple United States
| Service | What it does | What it receives |
|---|---|---|
| Apple sign-in | Lets you sign in with your Apple ID, if you choose to | Your name and email address (or Apple's private relay address), only when you use this sign-in method |
| Browser notifications (Safari and iPhone) | Delivers a notification to a Mac in Safari, or an iPhone or iPad with SMG Tools on its Home Screen, that a person turned notifications on for | An encrypted notification it cannot read, the address its browser was given for this site, and when it was sent. The notification itself says what happened, who and on which job — never a note’s words, an amount or an address |
Mozilla United States
| Service | What it does | What it receives |
|---|---|---|
| Browser notifications (Firefox) | Delivers a notification to a computer or phone whose Firefox browser a person turned notifications on for | An encrypted notification it cannot read, the address its browser was given for this site, and when it was sent. The notification itself says what happened, who and on which job — never a note’s words, an amount or an address |
Stripe United States
| Service | What it does | What it receives |
|---|---|---|
| Payments, Connect & Billing | Takes card payments from your clients and bills your subscription | Your business and bank details for payouts, your clients' names, emails and payment amounts. Card numbers go straight to Stripe and never reach us |
Plaid United States
| Service | What it does | What it receives |
|---|---|---|
| Bank connections | Imports your bank transactions so spending matches itself up | Your bank transactions and account names. Your banking login goes straight to Plaid and never reaches us; we store only the last four digits of an account |
Changes to this list
We update this page whenever we add or remove a service that handles customer data. The date at the top tells you when it last changed.
Questions about any of these, or about a data processing agreement for your own compliance needs? Email support@smgtools.com.