Sub-processors
Last updated: 2026-09-29
These providers may process personal data on our behalf, each only for the task in its row and under its own data-processing terms. None may use it to train its models. We give customers at least 14 days' notice by email before adding a sub-processor (see the DPA, section 6).
| Provider | What for | What it receives | Where | Transfer basis | When used |
|---|---|---|---|---|---|
| Supabase | Database and authentication | All account and project data | Region chosen for the project | SCCs in Supabase's DPA | Always |
| Vercel | Web application hosting | Requests to the dashboard, including account data in transit | United States and edge locations | EU–US Data Privacy Framework / SCCs | Always |
| Fly.io | Collection and analysis service | Monitored content, project configuration | Frankfurt, Germany | Within the EEA | Always |
| Stripe | Payments | Billing contact and payment details | United States | EU–US Data Privacy Framework / SCCs | Paid plans |
| Resend | Transactional email and alerts | Recipient email, alert content | United States | SCCs in Resend's DPA | Always |
| Serper, DataForSEO | Search-engine results, rankings, keyword and backlink data | The keywords, brand terms and domains you track | Per the provider's DPA | Per the provider's DPA | SEO and web monitoring |
| NewsAPI | News search | Your brand terms | Per the provider's DPA | Per the provider's DPA | News monitoring |
| EnsembleData | Public posts and comments from TikTok, Instagram, Threads, Reddit and Snapchat | Your brand terms; the public posts and comments returned, with authors' public handles | Per the signed DPA | SCCs where the processing is outside the EEA | When that collector is enabled |
| Apify | Retrieval of public pages from some platforms | Target URLs and search terms; the public content returned | European Union | Within the EEA | When that collector is enabled |
| Bright Data | Retrieval of public pages the owner has named, and public datasets | Target URLs; the public content returned | Israel | EU adequacy decision for Israel | Only for hosts named in configuration |
| Google (YouTube Data API) | Public videos and comments | Your brand terms; public video metadata and comments | United States | EU–US Data Privacy Framework | YouTube monitoring |
| Google (Search Console, Business Profile) | Your own site and business data | Data from accounts you connect | United States | EU–US Data Privacy Framework | Only with your OAuth consent |
| OpenRouter, Google (Gemini), OpenAI, Anthropic | Automated analysis: tone, topics, aspects, summaries, logos and objects in images | Excerpts of monitored content; never Telegram, LinkedIn or YouTube content | United States | EU–US Data Privacy Framework / SCCs | When an AI feature runs |
| OpenAI, Anthropic, Google, Perplexity, Mistral, xAI, DeepSeek, Meta | AI Visibility: asking assistants about your brand | The prompts you configure, no personal data of others | Per the provider's terms | Per the provider's terms | Only when you enable AI Visibility |
“Per the provider's DPA” means the location and transfer mechanism are those set in that provider's own data-processing agreement; ask info@monitelia.com for a copy.