Subprocessors
These providers process personal data for Check Your Website. If we signed a Data Processing Agreement with you (on request, see /dpa), we tell you 30 days before we add or replace one, so you can object.
| Provider | Purpose | Data | Region | Transfer basis |
|---|---|---|---|---|
| Vercel | Website hosting; AI Gateway that routes model calls | Web requests, IP address, AI prompts with page content | EU (Frankfurt) for functions; global CDN | DPF |
| Railway | Backend and background worker hosting | All service data while it is processed | EU (Amsterdam, Netherlands) | DPF |
| PlanetScale | Application database | Account, website, check, and Autopilot data | EU (Frankfurt, Germany) | DPF |
| Upstash | Job queues and rate limits | Job references and rate-limit counters | EU (Frankfurt, Germany) | DPF |
| Clerk | Sign-in and accounts | Name, email address, sign-in events, IP address | USA | DPF |
| Sentry | Error monitoring, without session replay | Error details, browser, IP address | EU (Frankfurt, Germany) | DPF |
| PostHog | Product analytics, only after consent | Pseudonymous ID, page views, product events, masked session replays on a few pages | EU (Frankfurt, Germany) | EU (no transfer) |
| Resend | Service emails | Email address, email content | USA (emails sent from Ireland) | DPF |
| Anthropic | Autopilot sandbox (Claude Managed Agents), called directly. Claude models for answers and the AI test go through Vercel AI Gateway | For Autopilot, your repository code; page content and questions | USA | SCC; Claude models via the Vercel DPA |
| OpenAI | AI models, via Vercel AI Gateway (Vercel’s subprocessor) | Page content and questions about your website | USA | Vercel DPA |
| Google (Gemini) | AI model, via Vercel AI Gateway (Vercel’s subprocessor) | Page content and questions about your website | USA | Vercel DPA |
| Google PageSpeed Insights | Page speed measurement, called directly | The public page URL only | USA | DPF |
| Perplexity | AI model (Sonar) in the AI test, via Vercel AI Gateway (Vercel’s subprocessor), without zero data retention | The page URL and the questions about your website, including questions you write yourself | North America (AWS) | Vercel DPA |
| TypeSafe | Structured AI decisions about page content, via Vercel AI Gateway (Vercel’s subprocessor) | Public page content, and the facts, messages, and questions you write yourself | USA | Vercel DPA |
| Firecrawl | Reading public pages when direct access fails | Page URL and public page content | USA | No personal data (public page content only) |
| GitHub | Autopilot access to the repository you connect | Repository code, branches, pull requests | USA | DPF |
| Lovable | Autopilot changes in the Lovable project you connect | Project code and changes | Region of your Lovable project (EU, USA, or Asia Pacific) | Your agreement with Lovable applies (you connect your own Lovable project). |
| Cal.com | Demo bookings | Name, email address, booking time | USA | DPF |
DPF means the provider is certified under the EU-US Data Privacy Framework. SCC means we use the Standard Contractual Clauses approved by the European Commission. Vercel DPA means the provider is Vercel’s subprocessor for AI Gateway: we have no direct contract with it, and our Data Processing Agreement with Vercel covers the transfer.
Questions about a provider, or an objection to a change: info@check-your-website.com.