Subprocessors
Last updated: 27 September 2026
These are the companies that receive personal data or customer content when you use Whaily, what each one gets, and where. The Privacy Policy explains why we process the data at all. When we add a company to this list we update this page first and tell account holders by email before any data goes to it.
The list
Vercel
- Purpose
- Hosting and delivery of this site and the app.
- Receives
- Every request you make to whaily.com, including your IP address and your session cookie.
- Location
- Frankfurt, Germany (fra1). Vercel Inc. is in the United States.
- Transfer route
- EU-US Data Privacy Framework where the company is certified under it, otherwise the European Commission standard contractual clauses in its data processing terms.
Neon
- Purpose
- The database.
- Receives
- Accounts, organisations, the prompts you configure, the domains you track, notes, and every AI answer we store.
- Location
- Frankfurt, Germany (eu-central-1). Neon Inc. is in the United States.
- Transfer route
- EU-US Data Privacy Framework where the company is certified under it, otherwise the European Commission standard contractual clauses in its data processing terms.
Google Cloud
- Purpose
- The background work: the functions that run your prompts, their queues, and our secret store.
- Receives
- The prompts, brands and domains a job works on, and the answers it collects.
- Location
- Frankfurt, Germany (europe-west3). Google LLC is in the United States.
- Transfer route
- EU-US Data Privacy Framework where the company is certified under it, otherwise the European Commission standard contractual clauses in its data processing terms.
Cloudflare
- Purpose
- DNS and traffic protection for whaily.com, and the Turnstile bot check on the sign-up, sign-in and invitation forms.
- Receives
- Your IP address and browser details when you visit, and the fact that a form was submitted.
- Location
- Global network. Cloudflare Inc. is in the United States.
- Transfer route
- EU-US Data Privacy Framework where the company is certified under it, otherwise the European Commission standard contractual clauses in its data processing terms.
Resend
- Purpose
- Sending email: sign-in links, invitations, notifications and digests.
- Receives
- Your email address and the content of each message.
- Location
- United States.
- Transfer route
- EU-US Data Privacy Framework where the company is certified under it, otherwise the European Commission standard contractual clauses in its data processing terms.
Google sign-in
- Purpose
- Signing in with a Google account, only if you choose it.
- Receives
- The sign-in request. Google returns your name and email address to us.
- Location
- United States (Google LLC).
- Transfer route
- EU-US Data Privacy Framework where the company is certified under it, otherwise the European Commission standard contractual clauses in its data processing terms.
Stripe and Link
- Purpose
- Payments. Stripe runs checkout and billing, and Link (Sold through Link, LLC, a Stripe company) is the merchant of record that sells the subscription, collects tax and sends receipts.
- Receives
- Your email address, your organisation name, the plan you buy, and the card and billing details you enter on Stripe’s own page. We never see or store card numbers.
- Location
- United States and Ireland.
- Transfer route
- EU-US Data Privacy Framework where the company is certified under it, otherwise the European Commission standard contractual clauses in its data processing terms.
Sentry
- Purpose
- Error reporting in the browser, only if you accept it in the cookie banner.
- Receives
- The error, the page address, your browser and operating system, and your IP address as your browser connects. No name, email address or cookies.
- Location
- Frankfurt, Germany (EU region). Functional Software, Inc. is in the United States.
- Transfer route
- EU-US Data Privacy Framework where the company is certified under it, otherwise the European Commission standard contractual clauses in its data processing terms.
TypeSafe
- Purpose
- A decision model that classifies the answers we collect (sentiment towards a brand) and the pages they cite (what kind of site each is).
- Receives
- Stored AI answers, the text of cited public pages, and the brand and competitor names being scored.
- Location
- United States (San Francisco).
- Transfer route
- EU-US Data Privacy Framework where the company is certified under it, otherwise the European Commission standard contractual clauses in its data processing terms.
DataForSEO
- Purpose
- Search ranking data for the keywords you track.
- Receives
- The keywords, domains and brand names we look up for you.
- Location
- Estonia (DataForSEO OÜ).
- Transfer route
- Inside the EU and EEA, so no transfer.
Anthropic
- Purpose
- Answering the prompts you track, which is what Whaily measures.
- Receives
- The prompt text you write and company names. When it is the model we analyse with, also stored answers and the text of your own public pages, to read brands and sentiment out of them. We store what it sends back.
- Location
- United States.
- Transfer route
- EU-US Data Privacy Framework where the company is certified under it, otherwise the European Commission standard contractual clauses in its data processing terms.
DeepSeek
- Purpose
- Answering the prompts you track, which is what Whaily measures.
- Receives
- The prompt text you write and company names. We store the answer it sends back.
- Location
- China.
- Transfer route
- No adequacy decision covers China, so we limit what goes there: only the prompt text you write and company names (your organisation, its industry and your competitors). We never send them your name, your email address or any other account or contact data. If you type personal data into a prompt yourself, it travels with that prompt.
- Purpose
- Answering the prompts you track, which is what Whaily measures.
- Receives
- The prompt text you write and company names. When it is the model we analyse with, also stored answers and the text of your own public pages, to read brands and sentiment out of them. We store what it sends back.
- Location
- United States.
- Transfer route
- EU-US Data Privacy Framework where the company is certified under it, otherwise the European Commission standard contractual clauses in its data processing terms.
OpenAI
- Purpose
- Answering the prompts you track, which is what Whaily measures.
- Receives
- The prompt text you write and company names. When it is the model we analyse with, also stored answers and the text of your own public pages, to read brands and sentiment out of them. We store what it sends back.
- Location
- United States.
- Transfer route
- EU-US Data Privacy Framework where the company is certified under it, otherwise the European Commission standard contractual clauses in its data processing terms.
Perplexity
- Purpose
- Answering the prompts you track, which is what Whaily measures.
- Receives
- The prompt text you write and company names. When it is the model we analyse with, also stored answers and the text of your own public pages, to read brands and sentiment out of them. We store what it sends back.
- Location
- United States.
- Transfer route
- EU-US Data Privacy Framework where the company is certified under it, otherwise the European Commission standard contractual clauses in its data processing terms.
xAI
- Purpose
- Answering the prompts you track, which is what Whaily measures.
- Receives
- The prompt text you write and company names. When it is the model we analyse with, also stored answers and the text of your own public pages, to read brands and sentiment out of them. We store what it sends back.
- Location
- United States.
- Transfer route
- EU-US Data Privacy Framework where the company is certified under it, otherwise the European Commission standard contractual clauses in its data processing terms.
Not on this list
If you connect Slack, messages go to the workspace you chose, which is your disclosure rather than ours. If you supply your own model provider keys, your prompts go to your own account with that provider. The public sites we read to check a brand’s presence (Reddit, Wikipedia and Wikidata, GitHub, Hacker News, Trustpilot, the Internet Archive) receive only a page address or a brand name, and are sources rather than processors.
Contact
Whaily is run by its founder in Sweden. Contact: [email protected].