Legal

Sub-processors

The third-party service providers we use to deliver Wispu, organized by purpose.

Last updated: 2026-07-29 · Operated by Kyba Ventures LLC (Wyoming, United States), which provides Wispu (the “Service”).

This page lists the sub-processors that may process personal data on Wispu’s behalf when you use the Service. Their processing is subject to the applicable data terms, including a Data Processing Agreement or comparable terms where required. Read this together with our Privacy Policy.

We notify customers via email and in-product notice at least 30 days before adding a new sub-processor that handles Customer Content, so you can object before the change takes effect.

Core infrastructure (first-party: data stays with us)

Provider	Purpose	Location
Supabase	Managed Postgres database, authentication, file storage, Edge Functions. Hosts the operational database, customer content, and auth state.	United States, European Union (configurable per region)
Railway	Auxiliary services we self-host (background workers, internal tooling). We run our own newsletter, CRM, and operational tooling here rather than send the data to third-party SaaS.	United States
Vercel	Hosting for the web application and marketing site. Edge network, serverless functions, image optimization, log retention.	Global edge network (United States primary)

Authentication and identity

Provider	Purpose	Location
Supabase Auth	User authentication, session management, email OTP, OAuth providers, and identity state.	United States, European Union (configurable per region)

Payments

Provider	Purpose	Location
Stripe	Payment processing, subscription billing, invoicing, tax calculation, fraud prevention. Card details are stored by Stripe (PCI-DSS Level 1).	United States, European Union, with global processors

AI inference

Provider	Purpose	Location
Vercel AI Gateway	Routes AI inference requests to underlying model providers and enforces request-level zero-data-retention routing for Wispu text generation.	United States
DeepInfra	Preferred inference route for DeepSeek V4 Flash text generation. Wispu requests only routes that Vercel AI Gateway marks as zero data retention.	United States
Fireworks AI	Fallback inference route for DeepSeek V4 Flash text generation, selected only under Wispu's zero-data-retention Gateway policy.	United States
Microsoft Azure	Fallback inference route for DeepSeek V4 Flash text generation, selected only when the Gateway reports a compatible zero-data-retention route.	Provider-selected Azure region
DigitalOcean	Zero-data-retention fallback inference route for DeepSeek V4 Flash when the preferred Gateway routes are unavailable.	Provider-selected region
Alibaba Cloud	Zero-data-retention fallback inference route for DeepSeek V4 Flash when the preferred Gateway routes are unavailable.	Provider-selected region
Baseten	Zero-data-retention fallback inference route for DeepSeek V4 Flash when the preferred Gateway routes are unavailable.	Provider-selected region
Anthropic	Claude family used as an independent judge for brand-voice evaluations through a zero-data-retention Gateway route.	United States
OpenAI	Used selectively for Vault audio/video transcription and 1536-dimension embeddings through zero-data-retention Gateway routes.	United States
xAI	Used for idea-recorder speech-to-text (Grok STT) through a zero-data-retention Gateway route.	United States
Google (Gemini)	Used selectively for Vault vision, Google Search-grounded trends, and Reader text-to-speech, generated directly through Google Cloud Text-to-Speech.	United States, European Union
OpenRouter	Rollback path for Reader audio generation (Gemini TTS) if Google Cloud Text-to-Speech is disabled. Wispu requires a zero-retention endpoint and denies provider data collection on every request. Inputs and outputs remain subject to OpenRouter and the selected model provider's terms.	United States, with model providers operating globally

Publishing and ingestion

Provider	Purpose	Location
Zernio	Multi-platform social-media publishing, scheduling, analytics, and inbox aggregation across 11 networks.	United States, European Union
Apify	Web scraping for the Reader and Vault features (public web pages, social posts ranked by engagement).	European Union (Czech Republic)
Firecrawl	Web extraction for Reader and Brand Knowledge ingestion from customer-selected public URLs.	United States

Operations and observability

Provider	Purpose	Location
PostHog	Product analytics, session replay (sampled), feature-flag delivery, A/B experimentation. EU region available for EU customers.	European Union, United States
Sentry	Error monitoring, exception tracking, performance metrics. Helps us diagnose runtime issues quickly.	United States
Tinybird	Stores and queries pseudonymous product, agent, and operational analytics events.	European Economic Area and United States

Email delivery

Provider	Purpose	Location
Resend	Transactional email delivery (sign-up confirmations, password resets, billing receipts, security notices).	United States

Marketing & advertising partners

These platforms are not sub-processors of Customer Content. We share limited marketing data with them (page visits, clicks, conversion events) to run paid campaigns and measure their performance. None of them receive your account credentials, brand context, drafts, or workspace content. In jurisdictions that require it (EU/UK), we activate them only after you opt in via the cookie banner.

Meta (Facebook, Instagram, WhatsApp)
Google (Ads, Analytics, YouTube)
X (Twitter)
TikTok
LinkedIn
Pinterest
Reddit
Snapchat

Notification of changes

We update this page when a sub-processor is added, removed, or changes role. Subscribe to change notifications by emailing team@wispu.app with the subject line “Subprocessor updates.”