Subprocessors
Last updated: August 22, 2026
These are the third-party companies that process data on our behalf so that Sunel can work. Each one receives only the categories listed, and several receive nothing at all unless you connect the feature that needs them. This page is referenced by section 7 of our Privacy Policy and forms part of it.
No subprocessor is permitted to train AI models on your data, to sell it, or to use it for advertising. Data we receive from Google APIs is additionally subject to the Limited Use commitments in section 5 of the Privacy Policy — Anthropic is the only subprocessor that receives Google-derived data.
Hosting and infrastructure
Always in the data path — these run the service itself.
- Purpose
- Virtual server running the application and the database.
- Data received
- All account data and project content stored by Sunel.
- Operates from
- Singapore
- Purpose
- DNS, TLS termination, web application firewall, and encrypted off-server backup storage.
- Data received
- Request metadata including IP address; encrypted database backups.
- Operates from
- United States (global edge network)
- Purpose
- Collects application errors so we can diagnose faults.
- Data received
- Error type, message, stack trace and technical labels. No content, no credentials, no request bodies.
- Operates from
- United States / European Union
- Purpose
- Visit statistics for our public pages only (home page, sign-in/sign-up, legal pages, invitation and share links) — never inside the signed-in product.
- Data received
- Page visited, referrer, browser and device type, approximate location (IP address is used for this and not stored), and a random visitor identifier cookie outside the EEA/UK/Switzerland. No account data, no content, no Google API data.
- Operates from
- United States
AI providers
None of them may train on your data. Described in full in section 6 of the Privacy Policy.
- Purpose
- Generates and reviews your marketing work.
- Data received
- Crawled text from your site, competitor page summaries, strategy documents, drafts and edits, analytics insight summaries, assistant messages, and Business Profile review text where connected. This is the only subprocessor that receives Google-derived data.
- Operates from
- United States
- Purpose
- Text embeddings used to detect duplicate and near-duplicate work.
- Data received
- Short text passages from your site pages and drafts. No Google data.
- Operates from
- United States
- Purpose
- AI-visibility measurement, and illustration images for articles.
- Data received
- Generic market questions and image prompts. No Google data, no personal data.
- Operates from
- United States
- Purpose
- AI-visibility measurement.
- Data received
- Generic market questions. No Google data, no personal data.
- Operates from
- United States
- Purpose
- Video generation.
- Data received
- The video prompt. No Google data.
- Operates from
- United States
Publishing and connected accounts
Only the ones you choose to connect.
- Purpose
- Authorized publishing provider for Instagram, Facebook, X and Google Business Profile. Holds the connection to each of those accounts.
- Data received
- Post content and media we publish for you. For Google Business Profile: business location information, local posts published on your approval, and reviews we read and reply to with your approval.
- Operates from
- United States
- Purpose
- Publishing posts to your own accounts.
- Data received
- Post content and the connection to your account.
- Operates from
- United States
- Purpose
- Publishing articles to your own site.
- Data received
- Article content, images and metadata.
- Operates from
- United States
- Purpose
- Opening pull requests against a repository you connect.
- Data received
- Proposed code changes and repository access.
- Operates from
- United States
- Purpose
- Optional notification and chat channel.
- Data received
- Your chat identifier and the messages you exchange with our bot.
- Operates from
- United Arab Emirates / global
Marketing data sources
- Purpose
- Backlink data and search-result data.
- Data received
- Your domain and the keywords we research. No personal data.
- Operates from
- United States
- Purpose
- Competitor discovery.
- Data received
- Search queries derived from your market. No personal data.
- Operates from
- United States
Business operations
- Purpose
- Payments and subscription management.
- Data received
- Your name, email and payment details, entered directly with Stripe. We never see or store card numbers.
- Operates from
- United States / Ireland
- Purpose
- Transactional email (verification, digests, billing notices).
- Data received
- Your email address and the content of the message we send you.
- Operates from
- United States
Changes to this list
We keep this page current rather than folding it into the Privacy Policy, so that vendor changes do not require re-versioning the policy itself. Adding a subprocessor that receives your content or personal data is still a material change to the Privacy Policy: we update the date above, and we notify existing customers by email before the change takes effect, as promised in section 15.
Questions, or a request for our data processing agreement: [email protected].