Loading…
Links last opened 17 October 2026. Record confirmed by a person on 5 October 2026. 6 recorded changes, listed below.
Clay contracts through Clay Labs Inc, registered in United States. Its trust center is published at https://trust.clay.com/. Its customer data processing agreement, also called a data processing addendum, is published by Clay itself; the link is below. Its sub-processor list is published by Clay itself; the link is below. We open those pages every day — last on 17 October 2026 — and a person last went through this record on 5 October 2026.
A ready row. Replace the purpose with what your client actually uses Clay for.
| Subprocessor | Legal entity | Country | Purpose | Transfer | DPA |
|---|---|---|---|---|---|
| Clay | Clay Labs Inc | US | CRM and marketing | — | https://www.clay.com/dpa |
Changes we noticed on Clay's own pages, each with the page we saw it on. The vendor does not publish this, and neither does anyone else.
17 October 2026
Clay now specifies that it uses standard contractual clauses (SCCs) and the UK Addendum as transfer mechanisms for moving customer personal data outside Europe, which is required for complying with international data transfer restrictions under GDPR and UK data protection law.
Seen on https://www.clay.com/dpa
16 October 2026
Clay's Data Processing Agreement that referenced standard contractual clauses (SCCs) as a transfer mechanism for international data transfers has been removed and is no longer available. This means the documented legal basis for transferring personal data outside the EEA, UK, and Switzerland is no longer in place.
Seen on https://www.clay.com/dpa
16 October 2026
The Data Processing Agreement page for Clay Labs Inc. is no longer accessible, making it impossible to verify the current contracting legal entity and data processing terms for subprocessor documentation and records of processing.
Seen on https://www.clay.com/dpa
14 October 2026
Clay's data processing agreement was updated with 2 lines removed, which appear to be marketing content unrelated to the agreement's substantive terms.
Seen on https://www.clay.com/dpa
9 October 2026
Clay's data processing agreement was updated with minimal substantive changes to the documented terms. The update removed extensive product feature descriptions and navigation elements while adding a reference to a "Sculpt keynote recap," suggesting a restructuring of the agreement format rather than changes to data handling practices or subprocessor information.
Seen on https://www.clay.com/dpa
8 October 2026
Clay updated its Data Processing Agreement to add Sana, Hex, OpenAI, and Merge as subprocessors while removing Verkada, Rootly, Harmonic, and Recharge. You should update your records of processing to reflect these four new subprocessors and remove the four discontinued ones.
Seen on https://www.clay.com/dpa
Enter your website: each service it loads, what it is for and links to its own DPA, in a minute or two. No sign-up.
Worked out from the registry and what we have written: the country this vendor contracts from, the guides that answer the question this page raises, and the rest of the registry.
Six of them. All crm and marketing in the registry.