Sub-processors
Last updated: 2026-05-25
SocialScalr (operated by WETYR Corporation) uses the third-party services below to deliver the platform. We publish this list because GDPR Art. 28 and most enterprise data-processing agreements require it.
Change policy. We update this page within 14 days
of any sub-processor change. Enterprise customers with a signed
DPA receive direct notification. To object to a new sub-processor,
email [email protected]
within 30 days of the change.
Core infrastructure
| Vendor | Service | Data category | Region | DPA |
|---|---|---|---|---|
| Supabase, Inc. | Postgres database, authentication, file storage, edge functions | All customer + lead data | US East (AWS us-east-1) | Link |
| Cloudflare, Inc. | CDN, WAF, DDoS protection, Pages hosting, Workers, KV | All HTTP traffic; IP addresses processed at edge but not retained as raw | Global anycast network | Link |
| Upstash, Inc. | Redis cache for rate-limiting + session counters | Hashed IPs only (sha256-salted) | US East | Link |
Communications
| Vendor | Service | Data category | Region | DPA |
|---|---|---|---|---|
| Resend (RZH Industries Inc.) | Transactional email (signup confirms, password resets, billing notices) | Customer email address, message body | US | Link |
| Apple Push Notification, Google FCM, Microsoft WNS | Web Push delivery endpoints (Settings → Notifications) | Opaque push endpoint URL only; no message body retained by us | Vendor-managed | Vendor terms |
Billing
| Vendor | Service | Data category | Region | DPA |
|---|---|---|---|---|
| Square, Inc. (Block) | Subscription billing, card processing, tax calculation, refunds, chargebacks | Customer name, email, billing address, card token, last-4. We never see raw card numbers. | US | Link |
Lead enrichment (used only when the customer triggers it)
| Vendor | Service | Data category | Region | DPA |
|---|---|---|---|---|
| Apollo.io | Email + company enrichment by name / LinkedIn URL | Lead identifier we send in the lookup (name or LinkedIn URL); we receive back email / phone / job title | US | Link |
| Hunter.io | Email-validity verification (deliverability check) | Email address only | EU (France) | Link |
AI features (used only when the customer triggers them)
| Vendor | Service | Data category | Region | DPA |
|---|---|---|---|---|
| Anthropic, PBC | AI text generation (Carousel topic-to-slides, post writer) | Prompt text the customer submits. Anthropic does NOT train on API data by default. | US | Link |
| OpenAI, LLC | Fallback AI text generation; content moderation classifier | Prompt text. OpenAI does NOT train on API data by default since March 2023. | US | Link |
CRM integrations (used only when the customer connects)
| Vendor | Service | Data category | Region | DPA |
|---|---|---|---|---|
| HubSpot, Inc. | OAuth-based push of leads + activity into the customer's HubSpot CRM | Lead records the customer chooses to sync | US / EU customer-elected | Link |
Operational tools (no customer data)
We use these internally for engineering. They do not process customer data and are listed for transparency only:
- GitHub (source control)
- Apify (LinkedIn Sales Navigator scraper, customer-triggered)
Sub-processors we deliberately do NOT use
- Google Analytics, Mixpanel, Segment, Heap, FullStory, PostHog — we built first-party analytics so customer behavior never reaches a third party.
- Facebook Pixel, LinkedIn Insight Tag, TikTok Pixel — no ad-platform pixels on socialscalr.com.
- Intercom, Drift, Hotjar, Crisp — no in-app chat widgets or session-replay tools.
How to contact us
Privacy + sub-processor questions: [email protected]
For a list of historical sub-processor changes (additions / removals over time), email the address above.