Asky

Asky Subprocessor List

To receive email notice of changes to this list, email [email protected].

Providers that process personal data only for Asky's own purposes (for example billing, CRM, marketing, consent management and internal tools) are not Subprocessors of Customer Personal Data and are included in Asky's Privacy Notice.

Section 1 - Asky sub-processors

Third parties Asky engages to process data on its customers' behalf.

Core infrastructure and hosting

  • Supabase (Supabase Pte. Ltd, Singapore) (supabase.com): primary database, authentication and file storage for the Service. Customer data is hosted on AWS in Stockholm, Sweden (eu-north-1). Transfers are safeguarded by the EU Standard Contractual Clauses incorporated into Supabase's Data Processing Addendum.
  • Vercel Inc. (vercel.com, USA): application hosting and CDN for the web app and APIs, plus cookieless Vercel Web Analytics. Serverless functions execute in the EU (Stockholm, Sweden); static content is served from Vercel's global edge network. Processes all inbound request traffic including IP addresses (transiently) and page/event counts.
  • Upstash, Inc. (upstash.com, USA): Redis for API rate limiting and caching. Rate-limit keys include user IDs and end-user IP addresses (short-lived). Hosted on AWS in Frankfurt, Germany (eu-central-1).
  • Inngest, Inc. (inngest.com, USA): background-job orchestration. Event payloads and step state can carry user IDs, brand IDs and recipient email addresses (for example, notification emails). Orchestration data is hosted on AWS in the United States; job code itself executes on Asky's EU infrastructure.
  • DigitalOcean, LLC (digitalocean.com, USA): hosts the real-time collaborative editing server for the content editor and the worker pool that executes monitoring prompts, on servers located in Frankfurt, Germany. Processes content draft data, prompt content and user session tokens in transit.

Email

  • Resend (Plus Five Five, Inc.) (resend.com, USA): transactional email (for example, workspace invitations and report emails). Processes recipient email addresses and email content. Emails are sent from Resend's EU region (Ireland, eu-west-1).
  • Loops (Astrodon Corporation) (loops.so, USA): product notification emails and email contact management. Processes user email addresses, names and product event data.

Analytics and observability

  • PostHog, Inc. (posthog.com, USA): product analytics and feature flags. Processes usage events and device data. Hosted in PostHog's EU Cloud in Frankfurt, Germany (eu.i.posthog.com).
  • Langfuse (Langfuse GmbH, Berlin, Germany, part of ClickHouse, Inc., USA) (langfuse.com): LLM tracing and observability. May process prompts and outputs for troubleshooting. EU cloud, hosted on AWS in Dublin, Ireland.
  • Grafana Cloud (Raintank, Inc. d/b/a Grafana Labs) (grafana.com, USA): metrics, logs and alerting platform. May ingest platform logs containing IP addresses. Stack hosted in Grafana Cloud's EU North region (Sweden).
  • Sentry (Functional Software, Inc.) (sentry.io, USA): application error monitoring. Error reports may include user identifiers, IP addresses and request metadata. Configured for EU data residency (Germany).
  • Cloudflare, Inc. (cloudflare.com, USA, infrastructure role): content delivery, DNS and security in front of the Service, operating on a global network. Processes request IP addresses.

AI / LLM providers

  • OpenAI (OpenAI Ireland Ltd, Dublin, Ireland, with processing performed by OpenAI OpCo, LLC, San Francisco, USA) (openai.com): core LLM and text-embeddings engine (sentiment, classification, keyword and prompt generation, content drafting, semantic search). Processes content submitted to the Service, which may include personal data. API data is not used to train OpenAI's models.
  • Anthropic, PBC (anthropic.com, USA): core LLM for the in-app assistant, long-form content writing and review, translation polish, and knowledge-base reasoning and PDF extraction. Processing takes place in the United States. API data is not used to train Anthropic's models.
  • Perplexity AI, Inc. (perplexity.ai, USA): AI search engine queried directly during brand onboarding (competitor detection). Processes brand information submitted to the Service.

Translation

  • DeepL SE (deepl.com, Cologne, Germany): machine translation of generated content drafts. Processing takes place in the EU. Translated content is not used to train DeepL's models.

Data and enrichment providers

  • Bright Data Ltd. (brightdata.com, Netanya, Israel; Israel is subject to an EU adequacy decision): web data collection used to execute monitoring prompts against AI search engines (for example ChatGPT, Perplexity, Google AI Overviews) and to collect public web data used in the Service. In the course of execution, prompt content configured by the customer is submitted to the respective AI search engines, and requests are routed through Bright Data's global network in order to execute queries from the customer's selected target locations.
  • DataForSEO OÜ (dataforseo.com, Tallinn, Estonia): search volume, AI visibility and backlink data. Processes keywords derived from customer prompts and customer website domains.
  • Jina AI (Jina AI GmbH, Berlin, Germany, part of Elastic N.V.) (jina.ai): web page content extraction for content generation and website indexing (public web content only). Processes customer website content, which may include personal data published on those pages.
  • Composio (Sampark Inc) (composio.dev, USA): integration platform brokering Reddit access, including customer-connected Reddit accounts. Stores connection credentials and processes Reddit content and account identifiers.
  • Google LLC (developers.google.com, USA): PageSpeed Insights API used for technical site audits. Processes customer website URLs only.

Section 2 - Customer-connected integrations (onward transfers)

Services the customer authorizes with their own account or credentials. Asky reads or publishes on the customer's instruction; OAuth tokens and credentials are stored encrypted at rest. These are customer-directed onward transfers rather than Asky's own sub-processors, but are listed for completeness.

  • Google Search Console (Google LLC, USA; Google Ireland Limited for EEA-based customers) (search.google.com/search-console): reads the customer's own Search Console data (queries, clicks, impressions, CTR, position) and can submit URLs for indexing.
  • Google Analytics 4 (Google LLC, USA; Google Ireland Limited for EEA-based customers) (analytics.google.com): reads the customer's own GA4 property metrics (users, sessions, pageviews and similar).
  • Webflow, Inc. (webflow.com, USA): publishes content, SEO fields and media to the customer's Webflow site; on connect, pulls the connecting Webflow user's name, email and avatar.
  • WordPress.com (Automattic Inc., USA) (wordpress.com): publishes posts and media to the customer's WordPress.com site; on connect, pulls the connecting user's username, display name, email and avatar.
  • WordPress (self-hosted / .org) (wordpress.org): publishes to the customer's own WordPress server via Application Password; pulls the WP user's name, email and profile. Data goes to the customer's own server.
  • Bing Webmaster Tools (Microsoft Corporation, USA) (bing.com/webmasters): connects to the customer's own Bing property for URL submission and index management.
  • Reddit (Reddit, Inc., USA; access brokered via Composio, see Section 1) (reddit.com): posts, comments and replies published from the customer's connected Reddit account on the customer's instruction; reads discussion threads and account identity.
  • Cloudflare, Inc. (customer OAuth, USA) (cloudflare.com): connects the customer's own Cloudflare zone to deploy a crawler-tracking Worker and read AI Crawl Control analytics (bot and crawler traffic to the customer's site).