Subprocessors
The companies that handle data on our behalf, what each one does, and what it can actually see. Last checked against the code on 2026-10-21.
| Company | What it does | What it can see | Where |
|---|---|---|---|
| Vercel | Runs the websites and the application | Every request: IP address, user agent, the page asked for | United States (iad1) |
| Supabase | Database, file storage and sign-in | Everything stored: accounts, form submissions, orders, photographs | United States (us-west-2) |
| Stripe | Takes payments and runs subscriptions | Name, email, billing address, card details — the card never reaches us | United States, global |
| Cloudflare | DNS for client domains | DNS records; resolver queries for those domains | Global |
| Resend | Sends transactional email | Recipient email address and the content of the message | United States |
| MXroute | Mailboxes on client domains | Mail sent to and from those mailboxes | United States |
| Twilio | Sends SMS | Recipient phone number and message content | United States |
| OpenAI | Generates website copy and drafts in the admin tools | Only the text we send to generate something — a brief, a draft, a prompt | United States |
| DeepSeek | Alternative model for the same generation work | The same: only the text sent to generate something | Configured per deployment |
Two worth calling out
Supabase holds everything — accounts, form submissions, orders and the Sparkler photographs. It is the one that matters most.
OpenAI and DeepSeek only ever receive the text we send to generate something: a brief for a page, a draft to rewrite. No customer records, no form submissions, no photographs, and nothing is used to train a model.
Changes
Adding a company to this list means it can see data that is not ours. We will tell account holders by email before a new one starts handling anything, with enough notice to object. To be told, write to hello@webplug.co.