SEORav · Legal
Sub-processor List
The third-party sub-processors SEORav uses to deliver the Services. Each is bound by a data processing agreement requiring GDPR-compliant data handling.
- Effective
- 2026-07-09
- Last updated
- 2026-07-09
- Version
- 1.2
We will provide 30 days’ notice (via email to active users and an update to this page) before adding a sub-processor that materially affects how we process customer data.
6.1 Infrastructure & data storage
| Sub-processor | Purpose | Region | Data shared |
|---|---|---|---|
| Supabase, Inc. | Postgres database, Auth (email, Google and Microsoft sign-in), Storage, Realtime, Edge Functions | EU (eu-west-2) | All application data, hashed credentials, OAuth identifiers, uploaded images |
| Vercel, Inc. | Web app hosting, edge functions, ISR for blog reader | Global edge network | Inbound HTTPS request bodies, server logs |
| Hostinger International Ltd. | Python API server hosting — content pipeline, crawler, citation polling, CMS webhooks | UK datacentre | All inbound API requests to Python server, server logs |
| Cloudflare, Inc. (R2) | Hosts the images we generate for your articles on permanent public URLs, so they load fast wherever your site is published | Global (Cloudflare network) | Generated image files and their filenames. No account data. |
6.2 AI processing
| Sub-processor | Purpose | Region | Data shared |
|---|---|---|---|
| Anthropic, PBC | The Claude models behind everything we write for you — outlines, drafts, optimization, AEO scoring, citation gap analysis, social variants, and outreach email drafts | US | Brand voice samples, keyword + outline data, draft content, citation responses for analysis. Anthropic does not train on commercial API data. |
| Voyage AI | Embeddings — keyword clustering, related-article matching, retrieval over crawled content | US | Keywords + page text snippets |
| Recraft | Generates the hero image and the in-article illustrations for your content, in your brand colours | US | Image prompt text derived from your article title and section topics. No account data, no article body. |
| Bright Data | (1) Citation scan proxy — when a citation scan runs, we route search-style queries to the public web interfaces of ChatGPT, Perplexity, Claude, Gemini, Copilot and Google AI Mode. (2) Page-analyzer fallback — fetches HTML for pages where anti-bot protection blocks our primary fetcher. | Global | AI prompts and target page URLs. In the backlink module, prospect page signals may be included in the prompt. |
| Standby image providers | Google Gemini, Fal.ai and Replicate are configured as fallbacks and are used only if Recraft is unavailable. Not currently active. | US | Image prompt text only |
6.3 Search & keyword data
| Sub-processor | Purpose | Region | Data shared |
|---|---|---|---|
| Serper.dev | Google SERP enrichment — keyword volumes, related queries, People-Also-Ask; also used to find backlink prospects and relevant discussion threads | US | Keywords, region/language hints, and — for prospect discovery — your domain and your competitors’ domains |
| DataForSEO | Real search-volume and keyword-difficulty data, and the backlink profiles (referring domains, authority, anchor text) behind the Authority module | US | Keyword seeds, your domain, competitor domains, target URLs |
| Google LLC (Trends) | Google Trends read-only API for demand validation | US | Keywords only (public Google service) |
6.4 Payments
| Sub-processor | Purpose | Region | Data shared |
|---|---|---|---|
| Stripe, Inc. | Payment processing via Stripe Checkout, subscription management via Customer Portal, one-off payments for Programmatic SEO batches, and billing webhooks | UK / US | Email, billing address, card details (handled directly by Stripe — we never receive card details) |
6.5 Publishing destinations you connect
These are platforms you connect and control. We send your finished content to them on your instruction. They act as recipients of your content rather than as our sub-processors, but we list them here for transparency.
| Destination | Purpose | Data shared |
|---|---|---|
| WordPress, Webflow, Ghost, HubSpot, Wix, Shopify, Framer, generic webhook | Publishes your articles and answer pages to your own site, with images, metadata and structured data attached | Article title and body, images, SEO metadata, and the credentials you supplied (encrypted at rest) |
| LinkedIn, X (Twitter), Facebook Pages | Publishes the social variants we repurpose from your articles to the accounts you connect | Post text, optional image, and your connected account identity |
| IndexNow (Bing, Yandex, Seznam) | Tells search engines about your new pages the moment they publish, so they get crawled sooner | Published page URLs only |
6.6 Outreach email
If you use the Authority module to run outreach, we send email through your own mailbox — it comes from your address, not ours. To do that we need the mailbox provider you connect.
| Sub-processor | Purpose | Region | Data shared |
|---|---|---|---|
| Google LLC (Gmail API) | Sends outreach email from your connected Gmail account and detects replies so we can track the conversation | US | Email subject and body, recipient addresses, and read access to the connected mailbox for reply detection |
| Microsoft Corporation (Graph) | Sends outreach email from your connected Outlook / Microsoft 365 account | US / EU per tenant | Email subject and body, recipient addresses |
Outreach emails contain a tracking pixel and rewritten links so you can see opens and clicks. We record the timestamp and a counter only — no IP address, device or location data is stored against a recipient.
6.7 Consent management
| Sub-processor | Purpose | Region | Data shared |
|---|---|---|---|
| Cookiebot (Usercentrics A/S) | Shows the cookie banner, records which categories you accepted, and keeps the consent log we are required to hold | EU (Denmark) | Your IP address in anonymised form, the consent choice, and the date it was given |
6.8 Analytics
| Sub-processor | Purpose | Region | Data shared |
|---|---|---|---|
| PostHog Inc. (EU instance) | Product analytics — page views, event tracking, feature flags, and session replay of dashboard interactions | EU (eu.i.posthog.com) | Pseudonymous distinct ID; user_id after sign-in; session recordings with input fields masked |
| Google LLC (Google Analytics 4) | Website analytics on our marketing pages and blog | US | Page views, GA client ID, page path |
Both are analytics cookies and load only after you accept them in our cookie banner. See the Cookie Policy.
6.9 Sign-in providers
| Sub-processor | Purpose | Region | Data shared |
|---|---|---|---|
| Google LLC (OAuth) | Google Sign-In, when you choose it | US | Email, name, Google ID |
| Microsoft Corporation (Entra ID) | Microsoft Sign-In, when you choose it | US | Email, name, Microsoft account ID |
6.10 Internal tooling — not separate sub-processors
The following are software libraries running inside our own infrastructure (not third-party services):
- Crawl4AI — Python library for production crawling, runs on our Hostinger Python API server
- Trafilatura, Extruct, spaCy, scikit-learn, HDBSCAN, RapidFuzz, Textstat, Advertools, Pytrends, TLDExtract — Python libraries for content processing, all running inside our infrastructure
Data processed by these libraries is handled by the underlying infrastructure providers (Hostinger and Supabase) already listed above.
6.11 International transfers
Sub-processors based outside the UK / EEA — notably Anthropic, Voyage AI, Recraft, Serper, DataForSEO, Bright Data, the Stripe US entity, Vercel, Cloudflare, Google, Microsoft, and PostHog’s underlying US infrastructure — receive data under Standard Contractual Clauses (SCCs) and the UK International Data Transfer Agreement (IDTA) where applicable. Hostinger (UK) and Supabase (EU) keep data within the UK and EEA respectively. Copies of the relevant transfer mechanisms are available on request from privacy@seorav.com.
6.12 How to object
Customers with active accounts can object to the addition of a new sub-processor by emailing privacy@seorav.com within 30 days of receiving notice. If the objection cannot be resolved, the customer may terminate their subscription with a pro-rata refund for the unused portion.
6.13 Notification of changes
For material changes — adding a new sub-processor, changing the region of an existing one, or expanding the categories of data shared — we will:
- Update this page
- Email all active customers at least 30 days before the change takes effect
- Allow customers to object as described above
6.14 Contact
Sub-processor questions: privacy@seorav.com