Trust
Who processes data on our behalf, what each one touches, and where it lives.
We hold no security certification and make no compliance claim on this page. What follows is the list itself, which is the thing you can actually check.
Subprocessors
| Subprocessor | What it does | Region | Data it touches | Retention | DPA |
|---|---|---|---|---|---|
| AI answer engines (OpenAI, Anthropic, Google Gemini, Perplexity, xAI Grok) | Querying answer engines to research and build teardowns and audits. | United States / global | Prompts about brands, products, domains, and public market topics. We do NOT submit confidential client business information or end-user personal data. | Business/API tiers used where available; abuse-monitoring retention varies by provider. | DPA (opens in a new tab) |
| Chatwoot | Support-inbox software (self-hosted). Its chat widget is currently DISABLED on our site; it would only process visitor data if we ever enable chat, and only after an affirmative pre-chat consent notice (shown before anything you type is transmitted or recorded). | Self-hosted on Hostinger VPS (EU) | Name, email, messages you provide, and a session identifier. | Kept for the correspondence and our records, then deleted; self-hosted on our Hostinger VPS. | DPA (opens in a new tab) |
| Cloudflare | Website hosting, DNS, CDN, and security/DDoS protection. | Global edge network | Connection data such as IP addresses. | Short, per Cloudflare's terms (logs rotate quickly). | DPA (opens in a new tab) |
| DataForSEO | Search-data and AI-answer-engine measurement APIs used to build audits. | United States / EU | Prompts about brands, products, domains, and public market topics — no client-confidential data. | Per DataForSEO's terms. | DPA (opens in a new tab) |
| Documenso | Electronic signature for contracts and statements of work (owner-armed). | Self-hosted on Hostinger VPS (EU) | Signer name, email, IP/audit metadata, and the document being signed. | For the life of the agreement plus our legal hold; documents stored on our Hostinger VPS instance. | DPA (opens in a new tab) |
| Google Workspace (Google LLC) | Business email and document/file storage. | United States / global | Your correspondence and any files exchanged. | Until deleted on our schedule; Workspace content is not used to train Google's models. | DPA (opens in a new tab) |
| Hostinger | VPS hosting for our self-hosted services (Chatwoot, Documenso, LanguageTool, uptime/change monitoring). | EU (data centre region as configured) | Whatever those self-hosted apps process — support chats, signed documents, ingested text — at rest on the VPS. | At rest until deleted on our schedule; encrypted backups rotate ~90 days. | DPA (opens in a new tab) |
| Instantly | Sending owner-approved outbound/cold business email (CASL/CAN-SPAM gated; never auto-sent). Only used when the outreach stream is active. | United States | Business prospect name, role, and published business email; message content. | Per Instantly's terms; suppression honoured via our permanent do-not-contact list. | DPA (opens in a new tab) |
| MailerLite | Email/newsletter delivery and subscriber management. | United States / EU | Name, email, engagement data. | Until unsubscribe or deletion; then suppression entry retained for opt-out proof. | DPA (opens in a new tab) |
| Plausible Analytics | Cookieless, aggregated, anonymized website analytics. | European Union | No personal identifiers; aggregate counts only. | Aggregate only; no personal data stored. | DPA (opens in a new tab) |
| Postiz | Scheduling and publishing social media posts. | EU / self-hostable | Public post content and the connected social-account access tokens. | Per Postiz's terms; post content is published publicly by design. | DPA (opens in a new tab) |
| Resend | Sending transactional and operational email. | United States | Recipient email and message content. | Short operational retention per Resend's terms. | DPA (opens in a new tab) |
| Stripe | Payment processing and billing. | United States / global | Card and payment data, billing name/email, country, charge status and amount. | Per Stripe's terms and our legal/tax hold (~6–7 years for financial records). | DPA (opens in a new tab) |
13 subprocessors. Last confirmed 2026-06-28. Rendered from business/config/subprocessors.json — this page cannot disagree with the register behind it.
What the measurement APIs receive
A measurement run sends the answer engines a buying-intent prompt about a product category. It does not send client data, customer data, or anything identifying a person. Results are stored against the category and the run date.
The rest of it
- Data Processing Agreement
- Privacy policy
- Deleting your data
- Accessibility statement
- Terms of service
- security.txt — how to report a vulnerability
- How we make our content — including where AI assists
- Changelog — every dated change to the method, the service and the prices