Sub-processors
Last updated: April 14, 2026
ChatSEO, operated by GROW IT, uses the following sub-processors to deliver its services. This page is maintained as a living document and updated whenever sub-processors are added, removed, or changed.
To be notified of changes to this list, enterprise customers with a Data Processing Agreement can subscribe to notifications by emailing [email protected].
Infrastructure & Hosting
| Sub-processor | Purpose | Data Processed | Location | Transfer Mechanism |
|---|---|---|---|---|
| Hetzner Online GmbH | Server hosting | All service data | Germany (EU) | N/A (EU) |
AI & Machine Learning
| Sub-processor | Purpose | Data Processed | Location | Transfer Mechanism |
|---|---|---|---|---|
| Vercel Inc. | AI inference gateway (AI Gateway): routes all inference requests | Conversation content, SEO data (transient, real-time inference only) | United States | 2021/914 SCCs + UK IDTA (not DPF-certified) |
| Anthropic PBC sub-processor of Vercel Inc. | Claude models: analysis, research and writing agents | Conversation content, SEO data (transient, real-time inference only) | United States | Via Vercel Inc. (2021/914 SCCs) |
| Perplexity AI, Inc. sub-processor of Vercel Inc. | Sonar model: web search feature only | Web search queries | United States | Via Vercel Inc. (2021/914 SCCs) |
| Voyage AI | Vector embeddings for cross-conversation memory | Text content for embedding generation | United States | SCCs |
Important: ChatSEO has no direct contractual relationship with Anthropic or Perplexity: these providers act as sub-processors of Vercel Inc., which operates the inference gateway. The providers in this chain do not use submitted data for model training. ChatSEO does not use any user data to train, fine-tune, or improve AI models.
Payment & Billing
| Sub-processor | Purpose | Data Processed | Location | Transfer Mechanism |
|---|---|---|---|---|
| Stripe, Inc. | Payment processing | Billing details, payment information, subscription data | United States | EU-US DPF + SCCs (PCI-DSS compliant) |
Communication
| Sub-processor | Purpose | Data Processed | Location | Transfer Mechanism |
|---|---|---|---|---|
| Resend | Transactional email delivery | Email address, name | United States | SCCs |
| Crisp IM SAS | Customer support chat | Name, email, chat conversations | France (EU) | N/A (EU) |
Analytics & Monitoring
| Sub-processor | Purpose | Data Processed | Location | Transfer Mechanism |
|---|---|---|---|---|
| Mixpanel, Inc. | Product analytics | Usage events, email, name | United States (EU endpoint) | EU-US DPF + SCCs |
| Customer.io (Peaberry Software Inc.) | Marketing automation | Email, name, usage events | United States (EU endpoint) | EU-US DPF + SCCs |
| Sentry (Functional Software Inc.) | Error monitoring | Technical errors, IP address, browser info | United States | EU-US DPF + SCCs |
Note: Mixpanel and Customer.io only receive data after explicit user consent via our cookie banner (analytics category). They do not initialize without consent.
SEO Data Providers
| Sub-processor | Purpose | Data Processed | Location | Transfer Mechanism |
|---|---|---|---|---|
| Google APIs (Google LLC) | OAuth authentication + Search Console API | OAuth tokens, GSC data (transient, never stored) | United States | EU-US DPF + SCCs |
| DataForSEO | SEO data (keyword research, SERP analysis, backlinks) | Public domain/URL data | United States | SCCs |
| Firecrawl | Web page content scraping | Public URLs, publicly accessible page content | Self-hosted (EU - Hetzner) | N/A (self-hosted, EU) |
Marketing & Attribution
| Sub-processor | Purpose | Data Processed | Location | Transfer Mechanism |
|---|---|---|---|---|
| Tolt, Inc. | Affiliate tracking | Referral attribution data | United States | SCCs |
| Meta Platforms, Inc. | Marketing analytics (Facebook Pixel) | Page views, conversion events | United States | EU-US DPF + SCCs |
Note: Tolt and Meta Pixel only receive data after explicit user consent via our cookie banner (marketing category). They do not load without consent.
Feature Management
| Sub-processor | Purpose | Data Processed | Location | Transfer Mechanism |
|---|---|---|---|---|
| Flagsmith | Feature flag management | User identifier | EU | N/A (EU) |
Important Notes
Consent-gated services
The following sub-processors only receive data after the user has given explicit consent via our cookie banner:
- Analytics (opt-in required): Mixpanel, Customer.io
- Marketing (opt-in required): Tolt, Meta Pixel
Without consent, these services do not initialize and receive no data.
Google Search Console data handling
Google Search Console data (queries, impressions, clicks, rankings, page performance) is fetched via the Google Search Console API in real-time using the read-only OAuth scope (webmasters.readonly). This data is returned directly to the user and is never stored in our database, cached in Redis, or persisted in any form. Only OAuth credentials (access token, refresh token) are stored to authenticate API requests on the user's behalf.
AI data handling
All inference is routed through the Vercel AI Gateway, which forwards requests to Anthropic (Claude models, all agents) and Perplexity (Sonar model, web search only). Voyage AI is called directly for embedding generation. Data is transmitted to them transiently, solely to fulfil the request, and is not used for model training.
Change Log
| Date | Change |
|---|---|
| September 1, 2026 | Added Vercel Inc. (inference gateway) and Perplexity AI, Inc.; corrected the AI chain's transfer mechanism |
| April 14, 2026 | Initial publication |