Sub-Processors

Last updated September 17, 2026

This page lists the third parties that process personal information on behalf of Legion Code Inc. (doing business as OSPRY) in connection with the Services. It is referenced by our Privacy Notice and by the Data Processing Agreement we enter into with customers.

Sub-processors fall into two layers, and the distinction matters, so we state it plainly rather than presenting a single flat list.

1. Identity-resolution supply chain (inherited)

OSPRY does not operate its own identity-resolution engine. Our visitor identification is resold from third-party providers, and the primary one's resolution runs on company data licensed from Demandbase. Because we resell those feeds, the providers' data flows are effectively part of our processing chain, and we disclose them here even though we do not control these vendor relationships and cannot alter them.

We work with more than one identity-resolution supplier. Which one resolves a given visit depends on coverage, so the flows below may not all apply to every visit. Suppliers differ in method: some produce a deterministic match and others a probabilistic one, which is why we describe identification as an estimate rather than a fact.

When the identification tag runs on a website, it shares the visitor's browser cookies with the following identity networks in order to obtain hashed email identifiers. Those networks return hashed identifiers, not people; the resolution from a hashed identifier to a name, business email, job title, and company happens on the provider's servers, not ours.

Attribution notice. The company-tier data is Demandbase's, and the SOC 2 attestation covering the resolution provider is that provider's, not OSPRY's. We do not present either as our own.

We do not hold, and do not claim, a security attestation covering the identity-resolution supply chain described above. Our agreement with that provider does not grant us rights in its certifications, and we do not present them as our own. We do hold a contractual right to receive information demonstrating that provider's compliance with its data-protection obligations, and to audit it.

2. OSPRY's own sub-processors (direct)

Identity, enrichment, and data sourcing

Artificial intelligence

Platform and operations

Not a sub-processor: our website analytics engine (Umami) is self-hosted on our own infrastructure with vendor telemetry disabled, so no visitor data is transmitted to a third party by it.

3. Website and marketing sub-processors

These process information about visitors to ospry.ai itself, as opposed to data processed on behalf of customers. Each is subject to the consent choice recorded in our Cookie Preference Center; see the Cookie Notice for the individual cookies.

4. Changes to this list

We will update this page when we add or replace a sub-processor. Customers under a Data Processing Agreement receive advance notice of a new sub-processor and may object within the window their agreement specifies.

We will give you at least 15 days' notice before a new sub-processor begins processing personal information, and you may object on reasonable grounds within 10 days of that notice. If we cannot accommodate your objection, either party may terminate.

To ask a question about this list, contact privacy@legioncodeinc.com.