Legal
Subprocessors
The trusted third parties we rely on to run vocabotics — and exactly what each one does with data on our behalf. No hidden players.
Last updated .
What a subprocessor is
To run vocabotics we use a small number of trusted third-party services — “subprocessors” — that may process personal data on our behalf, each under a contract that requires them to protect it. We choose them carefully, prefer EU-based providers, and send each one only the data it needs to do its job. The table below lists every subprocessor in use.
AI providers
Two of these are AI providers: Anthropic (the Claude models behind our content drafting and DIAGNOSE) and Voyage AI (the embeddings behind search). Under our agreements with them, the data we send through their APIs is not used to train their models. See the AI-use disclosure for the full picture.
Staying informed of changes
If we add or replace a subprocessor that handles personal data, we’ll update this page and its date above. Business customers under a data processing addendum can ask to be notified of material changes. Questions? Email privacy@vocabotics.com.
| Processor | What they do for us | Data involved | Location | Safeguard |
|---|---|---|---|---|
| Neon | Managed PostgreSQL database (primary application data store) | Account details, business profile, quiz/DIAGNOSE inputs, content | EU (Frankfurt) | Within EU/EEA |
| Upstash | Redis queue & cache (background jobs, rate limiting) | Transient job payloads, rate-limit and session keys | EU | Within EU/EEA |
| Cloudflare | Object storage (R2), CDN, DNS, web application firewall, bot protection (Turnstile) | Uploaded/generated files, IP addresses, request metadata | EU / global edge | SCCs / UK IDTA |
| Stripe | Payment processing and tax (VAT) | Name, email, billing address, transaction data (we never store full card details) | EU & US | SCCs; PCI-DSS |
| Resend | Transactional and newsletter email delivery | Name, email address, message content | US | SCCs |
| PostHog | Product analytics (consent-gated) | Pseudonymous usage events, device/browser data | EU (Frankfurt) | Within EU/EEA |
| Sentry | Error monitoring and performance diagnostics | Diagnostic data, IP address, request metadata | EU (data residency) | Within EU/EEA |
| Anthropic | Large language model (Claude) for content drafting and DIAGNOSE | Prompt content derived from your inputs (not used to train their models) | US | SCCs; no-training API terms |
| Voyage AI | Text embeddings for search and retrieval | Text derived from content and inputs | US | SCCs; no-training API terms |
| Cal.com | Booking and scheduling for consulting calls | Name, email address, booking details | EU | SCCs where applicable |
| Vercel | Hosting and CDN for the website front end | IP address, request metadata | EU / global edge | SCCs |
| Render | Hosting for the API, background worker and CMS | Account and application data in transit and at rest | EU (Frankfurt) | Within EU/EEA |
Next step
Questions about any of this? We’d rather you ask than wonder.