SEORav · Legal
Sub-processor List
The third-party sub-processors SEORav uses to deliver the Services. Each is bound by a data processing agreement requiring GDPR-compliant data handling.
- Effective
- 2026-05-08
- Last updated
- 2026-05-08
- Version
- 1.1
We will provide 30 days’ notice (via email to active users and an update to this page) before adding a sub-processor that materially affects how we process customer data.
6.1 Infrastructure & data storage
| Sub-processor | Purpose | Region | Data shared |
|---|---|---|---|
| Supabase, Inc. | Postgres database, Auth (email + Google OAuth), Storage (hero images), Realtime, Edge Functions | EU (eu-west-2) | All application data, hashed credentials, OAuth identifiers, uploaded images |
| Vercel, Inc. | Web app hosting, edge functions, ISR for blog reader | Global edge network | Inbound HTTPS request bodies, server logs |
| Hostinger International Ltd. | Python API server hosting (KVM 2 VPS) — pipeline, crawler, citation polling, CMS webhooks | UK datacentre | All inbound API requests to Python server, server logs |
6.2 AI processing
| Sub-processor | Purpose | Region | Data shared |
|---|---|---|---|
| Anthropic, PBC | Claude Sonnet 4.6 + Haiku 4.5 — outline, draft, optimization, AEO scoring, citation gap analysis | US | Brand voice samples, keyword + outline data, draft content, citation responses for analysis. Anthropic does not train on commercial API data. |
| Voyage AI | Embeddings (voyage-4-large) — keyword clustering, related-article matching, RAG over crawled content | US | Keywords + page text snippets |
| Brightdata | (1) Citation scan proxy — when a user runs a scan, we route generic search-style queries to ChatGPT, Perplexity, Claude, Gemini’s public web interfaces. (2) Page-analyzer fallback — fetches HTML for competitor pages where Cloudflare or other anti-bot protection blocks our primary fetcher. | Global | Generic AI prompts (no customer URLs or identifying data); target URLs of public competitor pages only. No customer credentials, content, or PII. |
| Image generation provider (planned) | Hero / inline image generation for blog posts and articles. Not yet active. | TBD | Prompt text only — vendor and region will be confirmed before launch. |
6.3 Data enrichment
| Sub-processor | Purpose | Region | Data shared |
|---|---|---|---|
| Serper.dev | Google SERP enrichment — keyword volumes, related queries, People-Also-Ask | US | Keywords, region/language hints |
6.4 Payments & communication
| Sub-processor | Purpose | Region | Data shared |
|---|---|---|---|
| Stripe, Inc. | Payment processing via Stripe Checkout, subscription management via Customer Portal, Stripe Webhooks for billing events | UK / US (PCI DSS Level 1) | Email, billing address, card details (handled directly by Stripe — we never receive card details) |
6.5 Analytics & observability
| Sub-processor | Purpose | Region | Data shared |
|---|---|---|---|
| PostHog Inc. (EU instance) | Product analytics — page views, event tracking, feature flags, session replay of dashboard interactions | EU (eu.i.posthog.com) | Pseudonymous distinct ID; user_id post-login; session recordings (with sensitive fields masked). Loaded only after consent. |
| Functional Software, Inc. (Sentry) | Error tracking, performance traces (server + client) | US (with EU regional option) | Stack traces, request paths, user_id (no email/PII — scrubbed at SDK level) |
| Vercel Analytics | Edge request metrics, page-load metrics | Per Vercel | Request metadata only — no user-identifying body |
6.6 Third-party identity & public data
| Sub-processor | Purpose | Region | Data shared |
|---|---|---|---|
| Google LLC (OAuth + Trends) | Google Sign-In OAuth (when customer chooses Google sign-up); Google Trends read-only API for demand validation | US | OAuth: email, name, Google ID. Trends: keywords only (public Google service). |
6.7 Internal tooling — not separate sub-processors
The following are software libraries running inside our own infrastructure (not third-party services):
- Crawl4AI — Python library for production crawling, runs on our Hostinger Python API server
- Trafilatura, Extruct, spaCy, scikit-learn, HDBSCAN, RapidFuzz, Textstat, Advertools, Pytrends, TLDExtract — Python libraries for content processing, all running inside our infrastructure
Data processed by these libraries is handled by the underlying infrastructure providers (Hostinger and Supabase) already listed above.
6.8 International transfers
Sub-processors based outside the UK / EEA (notably US-based providers Anthropic, Voyage AI, Stripe US entity, Sentry, Vercel, Google, Serper, and PostHog’s underlying US infrastructure) receive data under Standard Contractual Clauses (SCCs) and the UK International Data Transfer Agreement (IDTA) where applicable. Hostinger (UK) and Supabase (EU) keep data within the UK and EEA respectively.
6.9 How to object
Customers with active accounts can object to the addition of a new sub-processor by emailing privacy@seorav.com within 30 days of receiving notice. If the objection cannot be resolved, the customer may terminate their subscription with a pro-rata refund for the unused portion.
6.10 Notification of changes
For material changes — adding a new sub-processor, changing the region of an existing one, or expanding the categories of data shared — we will:
- Update this page
- Email all active customers at least 30 days before the change takes effect
- Allow customers to object as described above
6.11 Contact
Sub-processor questions: privacy@seorav.com