This is a previous version, in effect from August 4, 2026 to August 25, 2026. The current version is here.
Sub-processors
The vendors below process personal data in connection with the Services, as described in our Privacy Policy. Business customers receive 30 days’ notice of additions or replacements via our Data Processing Addendum.
| Vendor | Role — and what they receive | Location |
|---|---|---|
| Paddle (Paddle.com Inc. / Paddle.com Market Ltd.) | Merchant of record for purchases — an independent controller of transaction data: name, email, billing country, plan and transaction details. Card details are entered directly with Paddle and never reach us. | US/UK |
| Stripe | Payment processing for direct purchases: card details entered directly in Stripe checkout, billing name/email, transaction amount. We see only masked card data and payment status. | US |
| Anthropic | LLM API provider: product inputs and generation requests, served directly and via Google Vertex AI. Not used to train models. | US |
| Google Cloud | AI/compute infrastructure (Vertex AI): generation inputs where Claude is served via Vertex. | US |
| Vercel | Frontend and application hosting: request data incl. IP addresses. | US |
| DigitalOcean | Backend APIs, workers, managed PostgreSQL: account data, workspace content, encrypted connected-account tokens. | US |
| Cloudflare | DNS only (traffic is not proxied): DNS lookups, no page content. | US/global |
| Clerk | Authentication: name, email, credentials/OAuth identifiers, session and device data. | US |
| bundle.social (Bundle sp. z o.o.) | Social publishing and post analytics for connected accounts: OAuth tokens and content you publish. | EU (Poland; some providers may process outside the EEA) |
| twitterapi.io (Prism Digital, LLC) | Retrieval of public X/Twitter data: search queries derived from your product settings. | US (AWS; vendor states max 48h retention) |
| FastLane (Possibility Studios Pty Ltd) | AI short-form video generation: your product/project info. | Australia (may process outside AU via providers) |
| Apify (Apify Technologies s.r.o.) | Reddit account audit scraping: the Reddit username you submit. | EU/US |
| Exa | Web search for product/competitor research: queries derived from your product info. | US |
| Customer.io | Transactional and lifecycle email: contact attributes from signup/waitlist. | US |
| Sentry | Application error tracking: request metadata. | US |
| Axiom (Axiom, Inc.) | Log ingestion and querying: application logs, which may include identifiers and IPs. | US/EU (AWS + Cloudflare) |
| Amplitude | Marketing analytics on landing pages only: page events, device/browser data. | US |
| Google Analytics | Website analytics on marketing pages: page events, device/browser data and IP. | US |
| PostHog (PostHog, Inc.) | Product analytics infrastructure (US Cloud): app usage events and, where the HeyCatch SDK is enabled, the end-user events we process for that customer. No advertising use; session replay disabled. | US |
| Crisp (Crisp IM SAS) | Support chat on our website: chat messages, email if provided, device/usage metadata. | EU (France) |
| Upstash (Upstash, Inc.) | Queues and scheduled jobs: job payloads referencing user/workspace identifiers. | US/EU (AWS, region selectable) |
| Google Workspace | Corporate email/support: the content of your emails to support@heycatch.ai. | US/EU |