Subprocessors
Last updated: 2026-05-14
These third parties process customer data on our behalf. We commit to 30 days' notice before adding any new subprocessor or materially changing how an existing one is used. Active customers will be notified by email to the address on file.
Hosting + Infrastructure
| Subprocessor | Purpose | Data Processed | Location | DPA Link |
|---|---|---|---|---|
| Vercel | Application hosting + edge functions | Request metadata, log lines, brief content excerpts | USA | vercel.com/legal/dpa |
| Cloudflare | DNS, R2 object storage (images), Workers (proxy), Tunnel | Image bytes, request metadata, IP addresses | Global (Western North America for R2) | cloudflare.com/cloudflare-customer-dpa |
| Supabase | Primary database + auth + storage | All customer data (accounts, posts, drafts, channels, library, embeddings, audit log) | USA (us-east-2, OH) | supabase.com/legal/dpa |
Payments + Email
| Subprocessor | Purpose | Data Processed | Location | DPA Link |
|---|---|---|---|---|
| Stripe | Payments, subscriptions, invoicing | Billing email, card metadata (no card numbers), subscription state | USA | stripe.com/legal/dpa |
| Resend | Transactional email send + bounce/complaint webhook | Recipient email, subject, sent body | USA | resend.com/legal/dpa |
| Fastmail | Inbox for abuse@/unsubscribe@/hello@madcoolsocial.com (catch-all forwarding) | Inbound email | Australia (operator) | fastmail.com/about/dpa |
Publishing
| Subprocessor | Purpose | Data Processed | Location | DPA Link |
|---|---|---|---|---|
| Postiz | Social media publishing intermediary | Connected social channel tokens, post bodies, scheduled times, engagement metrics | USA | postiz.com/privacy |
AI / LLM
| Subprocessor | Purpose | Data Processed | Location | DPA Link |
|---|---|---|---|---|
| Cerebras Systems | Interactive LLM inference (intake chat, draft composition step) | Prompts (which include voice profile + topic excerpts), responses | USA | cerebras.ai/privacy |
| Groq | Long-context LLM inference (voice-profile distillation, voice-match scoring, edit-distillation, retros) | Prompts, responses | USA | groq.com/privacy-policy |
| MiniMax | Bulk LLM inference (research-item scoring) | Prompts (topic title + excerpt + voice tags), responses | Hong Kong + serving from global edge | minimax.io/privacy |
| Replicate | Hot-path image generation (Flux Schnell / 1.1 Pro / 1.1 Pro Ultra) | Image prompts | USA (now Cloudflare-owned per Nov 2025 acquisition) | replicate.com/privacy |
| Fal.ai | Instruction-driven image editing (Flux Kontext Pro / Max) | Image bytes + edit instructions | USA | fal.ai/privacy |
| Google AI Studio (Gemini API) | Conversational image editing (Nano Banana / Gemini 2.5 Flash Image) | Image bytes + edit prompts | USA | ai.google.dev/gemini-api/terms |
| Voyage AI (MongoDB) | Multimodal embeddings for the brand-asset library | Image bytes + caption text | USA | voyageai.com/privacy |
Observability
| Subprocessor | Purpose | Data Processed | Location | DPA Link |
|---|---|---|---|---|
| BetterStack (Logtail) | Log aggregation + uptime monitoring + Slack alerting | Log lines (may include account IDs and metadata, never PII) | USA | betterstack.com/privacy |
We do not sell customer data to any third party.