Plain-English summary
- A sub-processor is a third-party company we use to deliver SEO Genius (hosting, databases, email, error tracking, AI calls, SEO data).
- Each sub-processor only receives the data it needs for its specific job.
- We name every model provider that sees your data, including the one behind a routing layer (OpenAI, reached through OpenRouter) and one our software could reach but does not use (DeepSeek). Switching a provider on is never a silent change.
- We use a Data Processing Agreement (DPA) with each sub-processor that handles personal information. Execution status per vendor is listed in the table below and is being completed before public publish.
- When we add or change a sub-processor, we update this page and email active accounts at least 30 days before material changes take effect.
- You can subscribe to change alerts at the bottom of this page.
1. What is a sub-processor?
A sub-processor is a third party we use to deliver the Service. Each sub-processor only receives the data needed for its function. We use Data Processing Agreements with sub-processors that handle personal information.
We treat sub-processor selection as a privacy decision, not just a procurement decision. Before adding a new vendor that will touch user data, we review:
- What data they will receive
- Where they store it (data residency)
- Whether they have a signed DPA available
- Their security certifications (SOC 2, ISO 27001) where applicable
- Their own sub-processor chain (sub-sub-processors)
2. Current sub-processor list
The table below lists every third party that processes user data on our behalf as of the "Last updated" date above.
Reading the table:
- Vendor: the company name and link to their privacy resources.
- Purpose: what role they play in delivering the Service.
- Data shared: what categories of user data flow to them.
- Data residency: where the data is stored (primary region).
- DPA status: how data-processing terms apply with that vendor (published DPA, terms incorporation, or self-hosted). We describe only what is verifiably in place; we do not claim a separately executed agreement unless one exists.
2.1 Core infrastructure sub-processors
| Vendor | Purpose | Data shared | Data residency | DPA status |
|---|---|---|---|---|
| Supabase (privacy, DPA) | Primary database, authentication, file storage | All tenant data: account profile, connected sites, crawl artifacts, issues, actions, outcomes, memory records, embeddings | United States | DPA published by Supabase and applied to customer data under its terms; a countersigned copy is obtainable through the Supabase dashboard |
| Vercel (privacy, DPA) | Web application hosting and edge runtime | HTTP request data, IP addresses at request time, function execution logs | United States (Vercel's primary processing facilities per its DPA) | DPA published by Vercel and applied to customer data under its standard platform terms |
| Hetzner Online GmbH (privacy, DPA) | Servers that run our website crawler (Screaming Frog, section 2.6) and our PDF renderer | The URLs of sites a User has connected, the HTML, headers and metadata our crawler fetches from those sites, and the crawl export files while they are produced and uploaded to Supabase. No account data, billing data, or data read from Google. | United States (Hetzner's Ashburn, Virginia location); the company is registered in Germany | DPA published by Hetzner and available for conclusion in the Hetzner customer account |
| Cloudflare (conditional, privacy, DPA) | DNS, CDN, WAF, IP geolocation for signup gate | IP addresses, request metadata, country code header | United States and global edge network | Added when activated; DPA available |
2.2 Billing and authentication
| Vendor | Purpose | Data shared | Data residency | DPA status |
|---|---|---|---|---|
| Stripe (privacy, DPA) | Subscription billing, payment processing, invoice management | Name, email, billing address, payment method tokens (we never see card numbers), Stripe customer ID, plan tier, invoice history | United States | DPA auto-incorporated into Stripe Services Agreement |
2.3 Communications
| Vendor | Purpose | Data shared | Data residency | DPA status |
|---|---|---|---|---|
| Resend (operated by Plus Five Five, Inc.; privacy, DPA, sub-processors) | Transactional email delivery (OTP, password reset, billing receipts, security alerts) | Recipient email address, recipient name (if provided), email subject, email body, delivery events (sent, delivered, bounced, opened, clicked) | United States (primary processing operations per its DPA) | DPA published by Resend and applied to customer data under its terms |
| Dittofeed (self-hosted; project site) | Marketing email orchestration (drip campaigns, broadcasts) | Recipient email address, subscription state, behavior events, message templates | Self-hosted on our own Supabase / Vercel infrastructure | Self-hosted, no third-party data sharing beyond the underlying infrastructure already listed |
2.4 Observability
| Vendor | Purpose | Data shared | Data residency | DPA status |
|---|---|---|---|---|
| Sentry (privacy, DPA) | Application error tracking, performance monitoring, alerting | User ID, error context, stack traces, route names, breadcrumb events, browser metadata. Our Sentry SDK configuration does not send personal data by default (sendDefaultPii is off); Sentry may still infer an IP address from browser error reports at the network layer. | United States and Germany (per Sentry's privacy policy) | DPA published by Sentry and applied to customer data under its terms |
2.5 AI and language models
| Vendor | Purpose | Data shared | Data residency | DPA status |
|---|---|---|---|---|
| Anthropic, PBC (privacy, Commercial Terms, DPA, their sub-processors) | Large language model calls (Claude API) for niche detection, issue analysis, recommendation writing, business-profile extraction from your site, service-type classification, and mapping fixes into page-builder content | Per-call prompts including crawl text excerpts, page URLs, prompt template, response | Data is stored in the United States; inference may be routed to Anthropic servers in the US, Europe, Asia, or Australia per Anthropic's routing policy | DPA incorporated by reference into Anthropic's Commercial Terms of Service. Retention: API inputs and outputs are deleted from Anthropic's systems within 30 days by default; content flagged by Anthropic's automated trust and safety systems may be retained for up to 2 years. Training: Anthropic's Commercial Terms prohibit training its models on customer content submitted through the API. Zero Data Retention is not asserted unless and until a ZDR agreement is signed, and ZDR is unavailable for certain Anthropic models regardless. |
| OpenRouter, Inc. (privacy, terms, Trust Center) | Routing layer for embedding model calls. Every call is forwarded to the OpenAI model in the next row. | Per-call text payloads sent for embedding (page text, keyword strings, issue descriptions) | United States (OpenRouter operates from the US; the routed model provider processes each call under its own terms) | Data-processing terms referenced in OpenRouter's Terms of Service; full DPA available on request through OpenRouter's Trust Center. Retention: OpenRouter's Terms state that it does not store inputs after classifying them unless the account opts in to prompt logging. |
| OpenAI, L.L.C. (reached through OpenRouter; privacy, API data controls, DPA) | The embedding model (text-embedding-3-small) that turns page text, keyword strings and issue descriptions into the numeric vectors behind search and recommendations. Every embedding call we send to OpenRouter is served by this OpenAI model. | The same per-call text payloads listed for OpenRouter: page text excerpts, keyword strings, issue descriptions | United States | We do not hold a direct OpenAI account for this traffic; OpenAI processes it under OpenRouter's agreement with OpenAI. Retention and training: OpenAI's published API data controls state that API inputs are not used to train OpenAI models, and that embedding inputs are kept for up to 30 days for abuse monitoring and then deleted. We do not assert Zero Data Retention. |
| DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd.; conditional, not in use as of this update; privacy, Open Platform terms) | Our software contains an optional path that would send the recommendation-writing step (the short text that explains an issue and proposes a replacement value) to DeepSeek's API instead of Anthropic's. That path is switched off. We list it before any activation so that switching it on can never be a silent change. | Would receive, per call: issue descriptions and the current page values they refer to (titles, meta descriptions, headings, URLs) | People's Republic of China. DeepSeek's privacy policy states that it collects, processes and stores personal data in the People's Republic of China. | No DPA located for DeepSeek's API, and DeepSeek's privacy policy states that it may use inputs to train and improve its models. Activation would move data to a new country and to a vendor without a no-training commitment, so we treat it as a material change under section 3.1: active accounts get at least 30 days' email notice first, and this row changes to "active" before the first call is made. |
2.6 SEO data providers
| Vendor | Purpose | Data shared | Data residency | DPA status |
|---|---|---|---|---|
| DataForSEO (privacy, terms) | SERP results, keyword data, ranking data, backlink data | Domain names, keyword queries, location and language parameters | Infrastructure hosted on Google and Microsoft Azure facilities in the United States; company registered in Estonia | Data-processing terms incorporated into its Terms of Service |
| Screaming Frog SEO Spider (licensed software we run ourselves; vendor site) | Site crawling (HTML, headers, meta, internal links) | Website HTML and metadata for sites the user has connected | Runs on servers we rent from Hetzner in the United States (section 2.1). Crawl output is stored in Supabase. | Screaming Frog Ltd receives no crawl data; its license agreement covers the software only. The hosting provider is listed in section 2.1. |
| BrightLocal (conditional, privacy, terms) | Citation tracking, local SEO data, Google Business Profile audits | Business name, address, phone, website URL, category data | United Kingdom and United States (platform hosted in the UK per its privacy policy) | Added when activated; data-processing terms are set out in Section 9 of BrightLocal's Terms and Conditions |
2.7 User-connected Google APIs
| Vendor | Purpose | Data shared | Data residency | DPA status |
|---|---|---|---|---|
| Google APIs (Search Console, Analytics 4, Business Profile) (privacy, Google API Services User Data Policy) | User-connected analytics. The User authorizes us via OAuth to read data from their Google accounts. | OAuth refresh tokens (encrypted at rest), returned data from each API: GSC queries / pages / clicks / impressions / positions; GA4 sessions / users / events / conversions; GBP listing details, posts, reviews, photos | United States and global Google infrastructure | OAuth consent + Google API Services User Data Policy govern the relationship. We use Google data only for the user-facing features the User authorized. |
2.8 Product analytics on our marketing pages
The vendors below receive data about visitors to our public marketing pages only. They receive nothing from the signed-in application, and they receive nothing at all from a visitor who has not accepted analytics cookies. See our Cookies page section 3.2.
Unlike section 2.7, this is not data a User connects. It is our own measurement of our own website, so we are responsible for the lawful basis and for asking permission.
| Vendor | Purpose | Data shared | Data residency | DPA status |
|---|---|---|---|---|
| Microsoft Corporation (Microsoft Clarity; privacy statement, Clarity Terms of Use) | Product analytics and session recording on our public marketing pages, so we can find where the site confuses people. Loaded only after the visitor accepts analytics cookies. | Page interaction events (pages viewed, clicks, scroll depth, mouse movement), browser and device type, screen size, referring URL, IP address (used by Microsoft to derive an approximate country and region), and a first-party browser identifier. No account data, no customer site data, no Search Console or Analytics figures. | United States | Microsoft Online Services Data Protection Addendum, incorporated by reference into the Clarity Terms of Use. Microsoft acts as our processor for Clarity data. |
| Google LLC (Google Tag Manager; privacy, Tag Manager terms) | Tag loader on our public marketing pages. It delivers the Clarity tag above and nothing else. | HTTP request data at load time, including IP address and user agent. Tag Manager sets no cookies of its own and receives no interaction data. | United States and global Google infrastructure | Google Tag Manager Use Policy and the Google Ads Data Processing Terms. |
3. Sub-processor changes
3.1 Notification commitment
When we add or change a sub-processor, we will update this page within 7 days of the change taking effect. For material changes, we will email active accounts at least 30 days before the change takes effect.
A material change is any of the following:
- A new vendor that receives a new category of personal information not previously disclosed.
- A change in data residency that moves user data to a new country or region.
- A vendor replacement that materially changes the privacy posture (for example, swapping a SOC 2-attested vendor for one that is not).
Non-material changes (for example, a sub-processor that a current vendor uses changes, but our data flow does not change) will be updated on this page without a separate email.
3.2 Right to object
If you object to a new sub-processor for a material reason, contact us at the address in section 5 before the change takes effect. We will work with you in good faith. If we cannot resolve your objection, your remedy is to cancel your subscription before the change takes effect; we will pro-rate any unused portion of an annual plan per our refund policy.
3.3 Sub-processor selection criteria
We evaluate every prospective sub-processor against the following criteria before adding them:
- DPA availability: the vendor must offer a Data Processing Agreement.
- Security posture: SOC 2 Type 2, ISO 27001, or equivalent independent attestation preferred.
- Data residency: primary storage in the United States preferred during beta.
- Sub-processor chain: the vendor must publish its own sub-processor list.
- Incident history: material unresolved breach history is disqualifying.
4. Subscribe to sub-processor changes
To receive an email when we update this page, email support@seogenius.ai with the subject line "Subscribe: sub-processor changes" and we will add you to the notification list.
You can unsubscribe from sub-processor change alerts at any time. Unsubscribing does not affect transactional emails (billing, security, account) you receive as a User.
5. Contact
Privacy questions, sub-processor objections, and DPA requests:
Email: support@seogenius.ai Mail: Rize Digital LLC, 64 Codfish Hill Road, Bethel, CT 06801
We respond to all privacy and sub-processor inquiries within 5 business days.
6. Change log
- October 21, 2026: corrected and completed the AI and infrastructure rows. OpenAI added to section 2.5: every embedding call we route through OpenRouter is served by an OpenAI model, which this page previously described only as "the routed model provider". DeepSeek added to section 2.5 as a conditional vendor that our software can reach but does not use, so that switching it on can never happen without the section 3.1 notice; it would store data in the People's Republic of China. Hetzner Online GmbH added to section 2.1 as the hosting provider for our crawler and PDF renderer; the Screaming Frog row in section 2.6 previously said "our own infrastructure" without naming the host. The Anthropic row now lists every feature that calls the Claude API. No vendor started receiving new data on this date: OpenAI and Hetzner were already in the data flow and are now named, and DeepSeek receives nothing. We are treating this as a correction under section 3.1 rather than a material change, because no new category of data moved to a new category of vendor.
- August 3, 2026: added section 2.8 and two vendors, Microsoft Corporation (Microsoft Clarity, product analytics and session recording) and Google LLC (Google Tag Manager, tag loader). Both are limited to our public marketing pages, and Clarity receives nothing until a visitor accepts analytics cookies. Treated as a material change under section 3.1: active accounts are being notified, and neither vendor receives data from the signed-in application. See the Cookies page sections 3.2 and 3.3.
- July 9, 2026: first published. Vendor list, retention statements, and all vendor links verified as of this date.