Subprocessors
Last updated: 20 October 2026
These are the companies that receive personal data or customer content when you use Whaily, what each one gets, and where. The Privacy Policy explains why we process the data at all. When we add a company to this list we update this page first and tell account holders by email before any data goes to it.
The list
Cloudflare
- Purpose
- Hosting and delivery of this site and the app, whose server code runs on Cloudflare Workers. Also DNS and traffic protection for whaily.com, the Turnstile bot check on the sign-up, sign-in and invitation forms, and receiving email sent to a whaily.com address.
- Receives
- Every request you make to whaily.com, including your IP address, your browser details, your session cookie and what you send in a form, and every page we send back. Its request log keeps the address, IP address, browser details, status and timing of each request for 7 days. Cookie and API key values are blanked before that log is stored. Every email you send to a whaily.com address, which it passes to us and keeps as a raw copy for 24 months.
- Location
- Global network. A request reaches the Cloudflare location nearest you, and the app’s server code is set to run near our database in Frankfurt, Germany. Cloudflare Inc. is in the United States.
- Transfer route
- EU-US Data Privacy Framework where the company is certified under it, otherwise the European Commission standard contractual clauses in its data processing terms.
Vercel
- Purpose
- A standby copy of the app, kept while we finish moving hosting to Cloudflare so that we can switch back. It served whaily.com until 7 October 2026.
- Receives
- No request you make to whaily.com. The standby copy can read the database, so it stays on this list until it is shut down.
- Location
- Frankfurt, Germany (fra1). Vercel Inc. is in the United States.
- Transfer route
- EU-US Data Privacy Framework where the company is certified under it, otherwise the European Commission standard contractual clauses in its data processing terms.
Neon
- Purpose
- The database.
- Receives
- Accounts, organisations, the prompts you configure, the domains you track, notes, and every AI answer we store.
- Location
- Frankfurt, Germany (eu-central-1). Neon Inc. is in the United States.
- Transfer route
- EU-US Data Privacy Framework where the company is certified under it, otherwise the European Commission standard contractual clauses in its data processing terms.
Google Cloud
- Purpose
- The background work: the functions that run your prompts, their queues, and our secret store.
- Receives
- The prompts, brands and domains a job works on, and the answers it collects.
- Location
- Frankfurt, Germany (europe-west3). Google LLC is in the United States.
- Transfer route
- EU-US Data Privacy Framework where the company is certified under it, otherwise the European Commission standard contractual clauses in its data processing terms.
Resend
- Purpose
- Sending email: sign-in links, invitations, notifications, digests, and our replies to email you send us.
- Receives
- Your email address and the content of each message.
- Location
- United States.
- Transfer route
- EU-US Data Privacy Framework where the company is certified under it, otherwise the European Commission standard contractual clauses in its data processing terms.
Google sign-in
- Purpose
- Signing in with a Google account, only if you choose it.
- Receives
- The sign-in request. Google returns your name and email address to us.
- Location
- United States (Google LLC).
- Transfer route
- EU-US Data Privacy Framework where the company is certified under it, otherwise the European Commission standard contractual clauses in its data processing terms.
Stripe and Link
- Purpose
- Payments. Stripe runs checkout and billing, and Link (Sold through Link, LLC, a Stripe company) is the merchant of record that sells the subscription, collects tax and sends receipts.
- Receives
- Your email address, your organisation name, the plan you buy, and the card and billing details you enter on Stripe’s own page. We never see or store card numbers.
- Location
- United States and Ireland.
- Transfer route
- EU-US Data Privacy Framework where the company is certified under it, otherwise the European Commission standard contractual clauses in its data processing terms.
Sentry
- Purpose
- Error reporting in the browser, only if you accept it in the cookie banner.
- Receives
- The error, the page address, your browser and operating system, and your IP address as your browser connects. No name, email address or cookies.
- Location
- Frankfurt, Germany (EU region). Functional Software, Inc. is in the United States.
- Transfer route
- EU-US Data Privacy Framework where the company is certified under it, otherwise the European Commission standard contractual clauses in its data processing terms.
TypeSafe
- Purpose
- A decision model that classifies the answers we collect (sentiment towards a brand) and the pages they cite (what kind of site each is).
- Receives
- Stored AI answers, the text of cited public pages, and the brand and competitor names being scored.
- Location
- United States (San Francisco).
- Transfer route
- EU-US Data Privacy Framework where the company is certified under it, otherwise the European Commission standard contractual clauses in its data processing terms.
DataForSEO
- Purpose
- Search ranking data for the keywords you track.
- Receives
- The keywords, domains and brand names we look up for you.
- Location
- Estonia (DataForSEO OÜ).
- Transfer route
- Inside the EU and EEA, so no transfer.
Anthropic
- Purpose
- Answering the prompts you track, which is what Whaily measures.
- Receives
- The prompt text you write and company names. When it is the model we analyse with, also stored answers and the text of your own public pages, to read brands and sentiment out of them. We store what it sends back.
- Location
- United States.
- Transfer route
- EU-US Data Privacy Framework where the company is certified under it, otherwise the European Commission standard contractual clauses in its data processing terms.
DeepSeek
- Purpose
- Answering the prompts you track, and the brand and competitor questions we run on your tracked models, only where models served from China are switched on for your account. They are off for a new account until its owner switches them on. Accounts that already tracked DeepSeek on 27 September 2026, when it became opt-in, were kept on without that step; their owner can take it off the prompts and switch it off in Settings. Our internal processing, such as reading sentiment out of stored answers, never uses them.
- Receives
- The prompt text you write and company names. We store the answer it sends back.
- Location
- China.
- Transfer route
- No adequacy decision covers China, so we limit what goes there: only the prompt text you write and company names (your organisation, its industry and your competitors). We never send them your name, your email address or any other account or contact data. If you type personal data into a prompt yourself, it travels with that prompt.
- Purpose
- Answering the prompts you track, which is what Whaily measures.
- Receives
- The prompt text you write and company names. When it is the model we analyse with, also stored answers and the text of your own public pages, to read brands and sentiment out of them. We store what it sends back.
- Location
- United States.
- Transfer route
- EU-US Data Privacy Framework where the company is certified under it, otherwise the European Commission standard contractual clauses in its data processing terms.
OpenAI
- Purpose
- Answering the prompts you track, which is what Whaily measures.
- Receives
- The prompt text you write and company names. When it is the model we analyse with, also stored answers and the text of your own public pages, to read brands and sentiment out of them. We store what it sends back.
- Location
- United States.
- Transfer route
- EU-US Data Privacy Framework where the company is certified under it, otherwise the European Commission standard contractual clauses in its data processing terms.
Perplexity
- Purpose
- Answering the prompts you track, which is what Whaily measures.
- Receives
- The prompt text you write and company names. When it is the model we analyse with, also stored answers and the text of your own public pages, to read brands and sentiment out of them. We store what it sends back.
- Location
- United States.
- Transfer route
- EU-US Data Privacy Framework where the company is certified under it, otherwise the European Commission standard contractual clauses in its data processing terms.
xAI
- Purpose
- Answering the prompts you track, which is what Whaily measures.
- Receives
- The prompt text you write and company names. When it is the model we analyse with, also stored answers and the text of your own public pages, to read brands and sentiment out of them. We store what it sends back.
- Location
- United States.
- Transfer route
- EU-US Data Privacy Framework where the company is certified under it, otherwise the European Commission standard contractual clauses in its data processing terms.
Not on this list
If you connect Slack, messages go to the workspace you chose, which is your disclosure rather than ours. If you supply your own model provider keys, your prompts go to your own account with that provider. The public sites we read to check a brand’s presence (Reddit, Wikipedia and Wikidata, GitHub, Hacker News, Trustpilot, the Internet Archive) receive only a page address or a brand name, and are sources rather than processors.
Contact
Whaily is run by its founder in Sweden. Contact: hello@whaily.com.