| Provider | What for | What it receives | Where | When |
|---|---|---|---|---|
| Vercel (US)Privacy terms | Hosting, server functions and background scan workflows | Everything the site sends or receives, including IP address and request logs | United States (US East); public pages cached worldwide | Every visit |
| Supabase (US)Privacy terms | Database, sign-in and file storage | Account email, scans, reports, subscription status, privacy choices and first-party product events | United States | When you request a scan or sign in |
| DataForSEOPrivacy terms | Runs the ChatGPT, Gemini and Google AI Overviews queries and the search data behind each scan | Business name, website, category and market as written into scan prompts. Never your email address | Outside Canada (region not yet confirmed) | When a scan or rescan runs |
| Stripe (US and Canada)Privacy terms | Checkout, recurring billing, invoices, the billing portal and fraud checks | Name, email, billing address, payment method and purchase history. We never see full card numbers | United States and Canada | When you start checkout or subscribe |
| Resend (US)Privacy terms | Sending report, account and (if you opt in) lifecycle email | Email address, message content and delivery, bounce and complaint events | United States | When we email you |
| Cloudflare TurnstilePrivacy terms | Telling real visitors from bots on the scan form | IP address and browser signals | Worldwide network | When you use the scan form |
| Sentry (US)Privacy terms | Error monitoring | Technical details of an error: page, browser and device type, and the failing code. Default personal-data collection is off | United States | When something breaks |
| Crisp (EU)Privacy terms | Live support chat | Messages and any name or email you type into chat, plus browser, device and page details. If you open chat while signed in, your account email, your plan and a signed account reference, so we can answer paying customers first. The widget sets its own storage to keep a conversation open | European Union | The widget loads on public pages; messages only if you chat |
| PostHog (US)Privacy terms | Product analytics and masked session replay | Pages, product events, device class, coarse country and a replay with every form input masked | United States | Only after you allow Analytics |
| Google Analytics, Tag Manager and Google Ads (US)Privacy terms | Aggregate measurement and ad conversion reporting | Limited cookieless signals by default (see Cookies). With consent: analytics and conversion cookies and the ad click identifier | United States | Every visit, in restricted mode until you choose |
| GitHub (US), optionally Cloudflare R2 or Backblaze B2Privacy terms | Encrypted nightly database backups for disaster recovery | An encrypted copy of the database. Backups expire after about 35 days | United States | Nightly |
| Discord (US)Privacy terms | Internal team alerts | Business name or domain on plan changes, and the first lines of a support chat. Never billing details | United States | When those events happen |
| Gmail (US)Privacy terms | Our support and privacy inbox | Whatever you email us | United States | When you email us |
| OpenStreetMapPrivacy terms | Map images on reports | IP address and browser details, as with any image request | Worldwide network | When a report shows a map |
Most of these providers store and process information outside Canada and outside Quebec. Before using them, we assessed what each receives, why, how it is protected by contract and the laws of the country where it ends up. See section 4 of our privacy policy.
We update this page before a new provider starts receiving personal information. To hear about changes, or to get a provider's data processing terms, email morais.aaron@gmail.com.