Legal
Sub-processors
The third-party service providers we use to deliver Wispu, organized by purpose.
This page lists the sub-processors that may process personal data on Wispu’s behalf when you use the Service. Their processing is subject to the applicable data terms, including a Data Processing Agreement or comparable terms where required. Read this together with our Privacy Policy.
We notify customers via email and in-product notice at least 30 days before adding a new sub-processor that handles Customer Content, so you can object before the change takes effect.
Core infrastructure (first-party: data stays with us)
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Managed Postgres database, authentication, file storage, Edge Functions. Hosts the operational database, customer content, and auth state. | United States, European Union (configurable per region) |
| Railway | Auxiliary services we self-host (background workers, internal tooling). We run our own newsletter, CRM, and operational tooling here rather than send the data to third-party SaaS. | United States |
| Vercel | Hosting for the web application and marketing site. Edge network, serverless functions, image optimization, log retention. | Global edge network (United States primary) |
Authentication and identity
| Provider | Purpose | Location |
|---|---|---|
| Supabase Auth | User authentication, session management, email OTP, OAuth providers, and identity state. | United States, European Union (configurable per region) |
Payments
| Provider | Purpose | Location |
|---|---|---|
| Stripe | Payment processing, subscription billing, invoicing, tax calculation, fraud prevention. Card details are stored by Stripe (PCI-DSS Level 1). | United States, European Union, with global processors |
AI inference
| Provider | Purpose | Location |
|---|---|---|
| Vercel AI Gateway | Routes AI requests to the models Wispu chooses for each task. Every request carries the Gateway's no-training setting (disallowPromptTraining). Requests paid with the Gateway's own credits run with zero data retention. | United States |
| DeepInfra | Preferred inference route for DeepSeek V4 Flash text generation. Wispu requests only routes that Vercel AI Gateway marks as zero data retention. | United States |
| Fireworks AI | Fallback inference route for DeepSeek V4 Flash text generation, selected only under Wispu's zero-data-retention Gateway policy. | United States |
| Microsoft Azure | Fallback inference route for DeepSeek V4 Flash text generation, selected only when the Gateway reports a compatible zero-data-retention route. | Provider-selected Azure region |
| DigitalOcean | Zero-data-retention fallback inference route for DeepSeek V4 Flash when the preferred Gateway routes are unavailable. | Provider-selected region |
| Alibaba Cloud | Zero-data-retention fallback inference route for DeepSeek V4 Flash when the preferred Gateway routes are unavailable. | Provider-selected region |
| Baseten | Zero-data-retention fallback inference route for DeepSeek V4 Flash when the preferred Gateway routes are unavailable. | Provider-selected region |
| Anthropic | Claude models on Wispu's commercial API account, for text tasks. API data is not used for training. Inputs and outputs may be kept for up to 30 days only for abuse and misuse monitoring and safety, then deleted, unless an abuse investigation or a legal obligation requires longer. | United States |
| OpenAI | Models on Wispu's commercial API account, for text tasks, embeddings and transcription, and OpenAI Realtime as the real-time voice model of optional AI calls. API data is not used for training. Inputs and outputs may be kept for up to 30 days only for abuse and misuse monitoring and safety, then deleted, unless an abuse investigation or a legal obligation requires longer. | United States |
| xAI | Used for idea-recorder speech-to-text (Grok STT) through a zero-data-retention Gateway route. | United States |
| Google (Gemini) | Used selectively for Vault vision, Google Search-grounded trends, and Reader text-to-speech, generated directly through Google Cloud Text-to-Speech. | United States, European Union |
| OpenRouter | Rollback path for Reader audio generation (Gemini TTS) if Google Cloud Text-to-Speech is disabled. Wispu requires a zero-retention endpoint and denies provider data collection on every request. Inputs and outputs remain subject to OpenRouter and the selected model provider's terms. | United States, with model providers operating globally |
Publishing and ingestion
| Provider | Purpose | Location |
|---|---|---|
| Zernio | Multi-platform social-media publishing, scheduling, analytics, and inbox aggregation across 11 networks. Also connects optional AI calls over WhatsApp: it does not record audio by default and keeps only call metadata (numbers, duration, cost and end reason). | United States, European Union |
| Apify | Web scraping for the Reader and Vault features (public web pages, social posts ranked by engagement). | European Union (Czech Republic) |
| Firecrawl | Web extraction for Reader and Brand Knowledge ingestion from customer-selected public URLs. | United States |
Operations and observability
| Provider | Purpose | Location |
|---|---|---|
| PostHog | Product analytics, session replay (sampled), feature-flag delivery, A/B experimentation. EU region available for EU customers. | European Union, United States |
| Sentry | Error monitoring, exception tracking, performance metrics. Helps us diagnose runtime issues quickly. | United States |
| Tinybird | Stores and queries pseudonymous product, agent, and operational analytics events. | European Economic Area and United States |
Email delivery
| Provider | Purpose | Location |
|---|---|---|
| Resend | Transactional email delivery (sign-up confirmations, password resets, billing receipts, security notices). | United States |
Marketing & advertising partners
These platforms are not sub-processors of Customer Content. We share limited marketing data with them (page visits, clicks, conversion events) to run paid campaigns and measure their performance. None of them receive your account credentials, brand context, drafts, or workspace content. In jurisdictions that require it (EU/UK), we activate them only after you opt in via the cookie banner.
- Meta (Facebook, Instagram, WhatsApp)
- Google (Ads, Analytics, YouTube)
- X (Twitter)
- TikTok
- Snapchat
Notification of changes
We update this page when a sub-processor is added, removed, or changes role. Subscribe to change notifications by emailing team@wispu.app with the subject line “Subprocessor updates.”
Other legal documents
Questions about these documents? Email team@wispu.app.