Plain-English summary
- A sub-processor is a third-party company we use to deliver SEO Genius (hosting, databases, email, error tracking, AI calls, SEO data).
- Each sub-processor only receives the data it needs for its specific job.
- We use a Data Processing Agreement (DPA) with each sub-processor that handles personal information. Execution status per vendor is listed in the table below and is being completed before public publish.
- When we add or change a sub-processor, we update this page and email active accounts at least 30 days before material changes take effect.
- You can subscribe to change alerts at the bottom of this page.
1. What is a sub-processor?
A sub-processor is a third party we use to deliver the Service. Each sub-processor only receives the data needed for its function. We use Data Processing Agreements with sub-processors that handle personal information.
We treat sub-processor selection as a privacy decision, not just a procurement decision. Before adding a new vendor that will touch user data, we review:
- What data they will receive
- Where they store it (data residency)
- Whether they have a signed DPA available
- Their security certifications (SOC 2, ISO 27001) where applicable
- Their own sub-processor chain (sub-sub-processors)
2. Current sub-processor list
The table below lists every third party that processes user data on our behalf as of the "Last updated" date above.
Reading the table:
- Vendor: the company name and link to their privacy resources.
- Purpose: what role they play in delivering the Service.
- Data shared: what categories of user data flow to them.
- Data residency: where the data is stored (primary region).
- DPA status: how data-processing terms apply with that vendor (published DPA, terms incorporation, or self-hosted). We describe only what is verifiably in place; we do not claim a separately executed agreement unless one exists.
2.1 Core infrastructure sub-processors
| Vendor | Purpose | Data shared | Data residency | DPA status |
|---|---|---|---|---|
| Supabase (privacy, DPA) | Primary database, authentication, file storage | All tenant data: account profile, connected sites, crawl artifacts, issues, actions, outcomes, memory records, embeddings | United States | DPA published by Supabase and applied to customer data under its terms; a countersigned copy is obtainable through the Supabase dashboard |
| Vercel (privacy, DPA) | Web application hosting and edge runtime | HTTP request data, IP addresses at request time, function execution logs | United States (Vercel's primary processing facilities per its DPA) | DPA published by Vercel and applied to customer data under its standard platform terms |
| Cloudflare (conditional, privacy, DPA) | DNS, CDN, WAF, IP geolocation for signup gate | IP addresses, request metadata, country code header | United States and global edge network | Added when activated; DPA available |
2.2 Billing and authentication
| Vendor | Purpose | Data shared | Data residency | DPA status |
|---|---|---|---|---|
| Stripe (privacy, DPA) | Subscription billing, payment processing, invoice management | Name, email, billing address, payment method tokens (we never see card numbers), Stripe customer ID, plan tier, invoice history | United States | DPA auto-incorporated into Stripe Services Agreement |
2.3 Communications
| Vendor | Purpose | Data shared | Data residency | DPA status |
|---|---|---|---|---|
| Resend (operated by Plus Five Five, Inc.; privacy, DPA, sub-processors) | Transactional email delivery (OTP, password reset, billing receipts, security alerts) | Recipient email address, recipient name (if provided), email subject, email body, delivery events (sent, delivered, bounced, opened, clicked) | United States (primary processing operations per its DPA) | DPA published by Resend and applied to customer data under its terms |
| Dittofeed (self-hosted; project site) | Marketing email orchestration (drip campaigns, broadcasts) | Recipient email address, subscription state, behavior events, message templates | Self-hosted on our own Supabase / Vercel infrastructure | Self-hosted, no third-party data sharing beyond the underlying infrastructure already listed |
2.4 Observability
| Vendor | Purpose | Data shared | Data residency | DPA status |
|---|---|---|---|---|
| Sentry (privacy, DPA) | Application error tracking, performance monitoring, alerting | User ID, error context, stack traces, route names, breadcrumb events, browser metadata. Our Sentry SDK configuration does not send personal data by default (sendDefaultPii is off); Sentry may still infer an IP address from browser error reports at the network layer. | United States and Germany (per Sentry's privacy policy) | DPA published by Sentry and applied to customer data under its terms |
2.5 AI and language models
| Vendor | Purpose | Data shared | Data residency | DPA status |
|---|---|---|---|---|
| Anthropic, PBC (privacy, Commercial Terms, DPA, their sub-processors) | Large language model calls (Claude API) for niche detection, issue analysis, recommendation generation | Per-call prompts including crawl text excerpts, page URLs, prompt template, response | Data is stored in the United States; inference may be routed to Anthropic servers in the US, Europe, Asia, or Australia per Anthropic's routing policy | DPA incorporated by reference into Anthropic's Commercial Terms of Service. Retention: API inputs and outputs are deleted from Anthropic's systems within 30 days by default; content flagged by Anthropic's automated trust and safety systems may be retained for up to 2 years. Training: Anthropic's Commercial Terms prohibit training its models on customer content submitted through the API. Zero Data Retention is not asserted unless and until a ZDR agreement is signed, and ZDR is unavailable for certain Anthropic models regardless. |
| OpenRouter, Inc. (privacy, terms, Trust Center) | Routing layer for embedding model calls | Per-call text payloads sent for embedding (page text, keyword strings, issue descriptions) | United States (OpenRouter operates from the US; the routed model provider processes each call under its own terms) | Data-processing terms referenced in OpenRouter's Terms of Service; full DPA available on request through OpenRouter's Trust Center |
2.6 SEO data providers
| Vendor | Purpose | Data shared | Data residency | DPA status |
|---|---|---|---|---|
| DataForSEO (privacy, terms) | SERP results, keyword data, ranking data, backlink data | Domain names, keyword queries, location and language parameters | Infrastructure hosted on Google and Microsoft Azure facilities in the United States; company registered in Estonia | Data-processing terms incorporated into its Terms of Service |
| Screaming Frog SEO Spider (self-hosted runner; vendor site) | Site crawling (HTML, headers, meta, internal links) | Website HTML and metadata for sites the user has connected | Self-hosted on our own infrastructure | Self-hosted, no third-party data sharing. License agreement covers the software itself. |
| BrightLocal (conditional, privacy, terms) | Citation tracking, local SEO data, Google Business Profile audits | Business name, address, phone, website URL, category data | United Kingdom and United States (platform hosted in the UK per its privacy policy) | Added when activated; data-processing terms are set out in Section 9 of BrightLocal's Terms and Conditions |
2.7 User-connected Google APIs
| Vendor | Purpose | Data shared | Data residency | DPA status |
|---|---|---|---|---|
| Google APIs (Search Console, Analytics 4, Business Profile) (privacy, Google API Services User Data Policy) | User-connected analytics. The User authorizes us via OAuth to read data from their Google accounts. | OAuth refresh tokens (encrypted at rest), returned data from each API: GSC queries / pages / clicks / impressions / positions; GA4 sessions / users / events / conversions; GBP listing details, posts, reviews, photos | United States and global Google infrastructure | OAuth consent + Google API Services User Data Policy govern the relationship. We use Google data only for the user-facing features the User authorized. |
2.8 Product analytics on our marketing pages
The vendors below receive data about visitors to our public marketing pages only. They receive nothing from the signed-in application, and they receive nothing at all from a visitor who has not accepted analytics cookies. See our Cookies page section 3.2.
Unlike section 2.7, this is not data a User connects. It is our own measurement of our own website, so we are responsible for the lawful basis and for asking permission.
| Vendor | Purpose | Data shared | Data residency | DPA status |
|---|---|---|---|---|
| Microsoft Corporation (Microsoft Clarity; privacy statement, Clarity Terms of Use) | Product analytics and session recording on our public marketing pages, so we can find where the site confuses people. Loaded only after the visitor accepts analytics cookies. | Page interaction events (pages viewed, clicks, scroll depth, mouse movement), browser and device type, screen size, referring URL, IP address (used by Microsoft to derive an approximate country and region), and a first-party browser identifier. No account data, no customer site data, no Search Console or Analytics figures. | United States | Microsoft Online Services Data Protection Addendum, incorporated by reference into the Clarity Terms of Use. Microsoft acts as our processor for Clarity data. |
| Google LLC (Google Tag Manager; privacy, Tag Manager terms) | Tag loader on our public marketing pages. It delivers the Clarity tag above and nothing else. | HTTP request data at load time, including IP address and user agent. Tag Manager sets no cookies of its own and receives no interaction data. | United States and global Google infrastructure | Google Tag Manager Use Policy and the Google Ads Data Processing Terms. |
3. Sub-processor changes
3.1 Notification commitment
When we add or change a sub-processor, we will update this page within 7 days of the change taking effect. For material changes, we will email active accounts at least 30 days before the change takes effect.
A material change is any of the following:
- A new vendor that receives a new category of personal information not previously disclosed.
- A change in data residency that moves user data to a new country or region.
- A vendor replacement that materially changes the privacy posture (for example, swapping a SOC 2-attested vendor for one that is not).
Non-material changes (for example, a sub-processor that a current vendor uses changes, but our data flow does not change) will be updated on this page without a separate email.
3.2 Right to object
If you object to a new sub-processor for a material reason, contact us at the address in section 5 before the change takes effect. We will work with you in good faith. If we cannot resolve your objection, your remedy is to cancel your subscription before the change takes effect; we will pro-rate any unused portion of an annual plan per our refund policy.
3.3 Sub-processor selection criteria
We evaluate every prospective sub-processor against the following criteria before adding them:
- DPA availability: the vendor must offer a Data Processing Agreement.
- Security posture: SOC 2 Type 2, ISO 27001, or equivalent independent attestation preferred.
- Data residency: primary storage in the United States preferred during beta.
- Sub-processor chain: the vendor must publish its own sub-processor list.
- Incident history: material unresolved breach history is disqualifying.
4. Subscribe to sub-processor changes
To receive an email when we update this page, email support@seogenius.ai with the subject line "Subscribe: sub-processor changes" and we will add you to the notification list.
You can unsubscribe from sub-processor change alerts at any time. Unsubscribing does not affect transactional emails (billing, security, account) you receive as a User.
5. Contact
Privacy questions, sub-processor objections, and DPA requests:
Email: support@seogenius.ai Mail: Rize Digital LLC, 64 Codfish Hill Road, Bethel, CT 06801
We respond to all privacy and sub-processor inquiries within 5 business days.
6. Change log
- August 3, 2026: added section 2.8 and two vendors, Microsoft Corporation (Microsoft Clarity, product analytics and session recording) and Google LLC (Google Tag Manager, tag loader). Both are limited to our public marketing pages, and Clarity receives nothing until a visitor accepts analytics cookies. Treated as a material change under section 3.1: active accounts are being notified, and neither vendor receives data from the signed-in application. See the Cookies page sections 3.2 and 3.3.
- July 9, 2026: first published. Vendor list, retention statements, and all vendor links verified as of this date.