1. Sub-processors of Customer Data
These companies process Customer Data, including End User data, on our behalf. Each one is bound by written data protection terms. For transfers outside the EEA, we use the Standard Contractual Clauses or the EU-U.S. Data Privacy Framework (see our DPA).
| Sub-processor | Purpose | Data | Location |
|---|---|---|---|
| Microsoft Corporation (Microsoft Azure) | Hosting of the Whisperr API, workers and database. Cache, backups and secret storage. | All Customer Data, including End User data. | Sweden (Azure Sweden Central). Backups are copied to a second Azure region in Sweden. |
| Cloudflare, Inc. | Network edge for api.whisperr.net, app.whisperr.net and our websites: TLS, routing and attack protection. | Data in transit, IP addresses and request metadata. | Global edge network. Cloudflare is a US company. |
| OpenAI, L.L.C. | AI models. Message writing, event and audience analysis, and code reading for the PR agent. | Business context, event names and counts, and filtered activity summaries. The message writer does not receive the End User’s name trait. Source code for the PR agent. No email addresses, phone numbers or push tokens. | United States. |
| Anthropic, PBC | AI models. Install wizard, PR agent, onboarding and dashboard assistants. | Business context, event definitions and source code. Little or no End User data. | United States. |
| Supabase, Inc. | Sign-in for the Whisperr dashboard and storage of onboarding answers. | Customer staff accounts (name, email, sign-in data) and onboarding data. No End User data. | United Kingdom (London). |
| PostHog, Inc. | Product analytics for the dashboard and service telemetry for the backend. | Staff user IDs, workspace and app IDs, feature usage, errors, and AI usage metadata (model, tokens, cost). No message text or prompt content. | United States. |
| GitHub, Inc. | The Whisperr PR agent GitHub App. Only if a Customer installs it. | Source code in the repositories the Customer selects, and pull requests that the agent opens. | United States. |
2. Service providers for our own business
These companies process data for which Whisperr is the controller: website visitors, billing and our own email. They do not process End User data.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Stripe, Inc. | Billing and payments for Whisperr plans. | Billing contact, company details, plan and payment data. Stripe holds card details. We do not. | United States. |
| Resend (Plus Five Five, Inc.) | Account emails from Whisperr, such as sign-up verification and password reset. | Staff email address and the email content. | Sending region in the EU (Ireland). Resend is a US company. |
| Google LLC (Google Workspace) | Our company email, including privacy, security and support mail. | The content of emails you send to us. | United States and other countries. |
| Cal.com, Inc. | Booking of walkthrough calls from our website. | Name, email and booking details that you enter. | United States. |
| Lovable (Lovable Labs Incorporated) | Backend of our Product Hunt launch-list form. | Email address, profile answers and referral data that you enter. | Provider-managed hosting. We treat this as a transfer outside the EEA. |
| Vercel, Inc. | Hosts the Whisperr Recall chat widget that some pages of whisperr.net show. | Messages you type in the widget, and request metadata. | United States. |
| Google LLC (Google Fonts) | Web fonts on our websites. | Your IP address and browser data, sent by your browser when it loads the fonts. | United States and other countries. |
3. Providers that you connect
When you connect your own provider, that provider works for you, not for Whisperr. It is not a Whisperr sub-processor. Whisperr uses your credentials to act on your instructions. Examples:
- Email: Resend, Postmark.
- Push: OneSignal, Firebase Cloud Messaging, Apple Push Notification service, Expo.
- Data sources: Stripe, RevenueCat, Shopify, Segment, Auth0, Clerk, Supabase.
- Your own server, when you use the relay webhook.
Your agreement with each provider governs how it handles data.
4. Changes and notice
We give at least 30 days’ notice before a new sub-processor starts to process Customer Data. We post the change on this page and email account owners. To get these notices at another address, write to privacy@whisperr.net with the subject “Sub-processor updates”.
You can object to a new sub-processor on reasonable data protection grounds within those 30 days. Section 7 of the DPA explains what happens next.
Last updated: October 8, 2026.
Questions? privacy@whisperr.net