Sub-processors

Last updated: 2026-07-22

How to read this list

For every sub-processor we disclose its name, the service we use it for, the region where data is processed, the categories of data it receives, and a link to its own privacy policy. This page is the single source of truth, referenced by our Privacy Policy and, where applicable, our Data Processing Addendum. It reflects the services that are actually wired into the product, grouped by function.

Self-hosted components are not listed. Some processing runs on infrastructure we operate ourselves rather than a third party — for example, report PDFs are rendered by a self-hosted headless browser, not an external rendering service. Those are covered by the platform providers above (Vercel, Supabase) and are not separate sub-processors.

Infrastructure suppliers are not sub-processors. Delivering the Service also relies on infrastructure suppliers that retrieve public web content and process only system-generated, non-personal data — for example, public URLs and the market-research queries we generate to measure brand visibility. They do not receive customer personal data, and are therefore not sub-processors under Article 28 of the GDPR, so they are not listed individually here.

Advertising & attribution partners

These receive data from the pixels on our marketing site so we can measure our own ad campaigns, build retargeting audiences, and credit the partner who referred you. Unlike the sub-processors above, they also use this data for their own purposes as independent controllers. Their pixels load only where and when permitted; see our Cookie Policy for how this works in your region and how to opt out.

International transfers

Your account and audit data are stored primarily in the European Union (Supabase in Ireland; Vercel in Frankfurt). Several sub-processors — notably the AI model providers and some analytics tools — operate in the United States or globally. When personal data is transferred out of the EEA, UK, or Switzerland, we rely on an appropriate safeguard: the EU-US Data Privacy Framework where the recipient is certified, the European Commission's Standard Contractual Clauses, and the UK Addendum and Swiss adequacy references as applicable. Our Data Processing Addendum incorporates these safeguards for customers who need one.

Notification of changes

We commit to notify customers at least 30 days in advance of:

• Adding a new sub-processor that handles customer data;
• Changing the region where an existing sub-processor operates; or
• Materially expanding the categories of data a sub-processor receives.

Notification methods: email to the account billing contact, an in-app notice, and an update to this page. The change history of this list is available on request to dpo@findrix.ai.

Your right to object

Customers on plans that include a Data Processing Addendum may object, in writing, to a new sub-processor within the 30-day notice window on reasonable, documented data-protection grounds. We will work in good faith to address the objection; if it cannot be resolved because the sub-processor is essential to the Service, you may terminate the affected subscription and receive a pro-rata refund of prepaid, unused fees.

Contact

Sub-processor and data-protection questions: dpo@findrix.ai