Legal

Sub-processors

The third-party service providers we use to deliver Wispu, organized by purpose.

Last updated: 2026-07-29 · Operated by Wispu (the “Service”).

This page lists the sub-processors that may process personal data on Wispu’s behalf when you use the Service. Their processing is subject to the applicable data terms, including a Data Processing Agreement or comparable terms where required. Read this together with our .

We notify customers via email and in-product notice at least 30 days before adding a new sub-processor that handles Customer Content, so you can object before the change takes effect.

Core infrastructure (first-party: data stays with us)

Provider	Purpose	Location
Supabase	Managed Postgres database, authentication, file storage, Edge Functions. Hosts the operational database, customer content, and auth state.	United States, European Union (configurable per region)
Railway	Auxiliary services we self-host (background workers, internal tooling). We run our own newsletter, CRM, and operational tooling here rather than send the data to third-party SaaS.	United States
Vercel	Hosting for the web application and marketing site. Edge network, serverless functions, image optimization, log retention.	Global edge network (United States primary)

Authentication and identity

Provider	Purpose	Location
Supabase Auth	User authentication, session management, email OTP, OAuth providers, and identity state.	United States, European Union (configurable per region)

Payments

Provider	Purpose	Location
Stripe	Payment processing, subscription billing, invoicing, tax calculation, fraud prevention. Card details are stored by Stripe (PCI-DSS Level 1).	United States, European Union, with global processors

AI inference

Provider	Purpose	Location
Vercel AI Gateway	Routes AI inference requests to underlying model providers. Acts as a unified gateway in front of Anthropic, OpenAI, Google, and others.	United States
Anthropic	Claude family of large language models, used for ideation, drafting, editing, brand-context-aware generation. Bound by zero-retention and no-training-on-customer-data agreements where available.	United States
OpenAI	GPT family of large language models, used for ideation, drafting, embedding, and image generation. Bound by API-tier data-handling terms (zero-retention by default).	United States
Google (Gemini)	Gemini family of language and multimodal models, used selectively for transcription and audio understanding.	United States, European Union
OpenRouter	Routes Reader audio-generation requests to selected model providers. Inputs and outputs are subject to OpenRouter and the selected model provider's data practices.	United States, with model providers operating globally

Publishing and ingestion

Provider	Purpose	Location
Zernio	Multi-platform social-media publishing, scheduling, analytics, and inbox aggregation across 11 networks.	United States, European Union
Apify	Web scraping for the Reader and Vault features (public web pages, social posts ranked by engagement).	European Union (Czech Republic)
Firecrawl	Web extraction for Reader and Brand Knowledge ingestion from customer-selected public URLs.	United States

Operations and observability

Provider	Purpose	Location
PostHog	Product analytics, session replay (sampled), feature-flag delivery, A/B experimentation. EU region available for EU customers.	European Union, United States
Sentry	Error monitoring, exception tracking, performance metrics. Helps us diagnose runtime issues quickly.	United States
Tinybird	Stores and queries pseudonymous product, agent, and operational analytics events.	European Economic Area and United States

Email delivery

Provider	Purpose	Location
Resend	Transactional email delivery (sign-up confirmations, password resets, billing receipts, security notices).	United States

Marketing & advertising partners

These platforms are not sub-processors of Customer Content. We share limited marketing data with them (page visits, clicks, conversion events) to run paid campaigns and measure their performance. None of them receive your account credentials, brand context, drafts, or workspace content. In jurisdictions that require it (EU/UK), we activate them only after you opt in via the cookie banner.

Meta (Facebook, Instagram, WhatsApp)
Google (Ads, Analytics, YouTube)
X (Twitter)
TikTok
LinkedIn
Pinterest
Reddit
Snapchat

Notification of changes

We update this page when a sub-processor is added, removed, or changes role. Subscribe to change notifications by emailing team@wispu.appwith the subject line “Subprocessor updates.”