Subprocessors
Effective August 16, 2026 · Last updated August 16, 2026
Everyone who touches your data on our behalf, what they do with it, and how far in advance we tell you when that list changes.
What this page is
A subprocessor is a company we engage to process customer data in order to deliver Pocky. Each one is bound by contract to use that data only on our instructions and only to provide its service to us. None of them may use your content for their own purposes. Our AI model provider is additionally prohibited by contract from training models on anything we send it.
This list is complete as of the date at the top of the page. It is referenced by our Privacy Policy, which explains what each category of data actually is.
Current subprocessors
| Subprocessor | What it does for us | Data it processes | Where |
|---|---|---|---|
| Anthropic, PBC | AI model inference. Receives brand and campaign inputs to generate briefs. Contractually prohibited from training on them. | Brand and campaign content, prompt text, generated briefs, request identifiers, and a pseudonymous account identifier so Anthropic can enforce its Usage Policy | United States |
| Supabase, Inc. | Primary database, authentication and file storage. Holds accounts, brands, campaigns and briefs. | Account data, brand and campaign content, generated briefs, usage records | United States |
| Vercel, Inc. | Application hosting, edge network and function logs. Every request passes through it. | Request metadata, IP address, short-lived application logs | United States |
| Stripe, Inc. | Payment processing, subscription management and the customer billing portal. Stripe is the only party that holds your card details. | Name, email, billing address, payment method, transaction and invoice history | United States |
| PostHog, Inc. | Product analytics, session recording, feature flags, error tracking and application logs. Optional; you can opt out. | Account identifier and email address, name and company if you joined the waitlist, session recordings of the interface as you saw it, page and feature events, device and browser data, approximate location from IP, error diagnostics and server log records | United States |
| Slack Technologies, LLC | Receives a notification when someone joins the waitlist, so we can respond. Delivered by PostHog, not by us directly. | Email address, name and company from a waitlist submission | United States |
| Resend, Inc. | Listed ahead of use, for transactional email such as billing and policy notices. Not yet integrated: all email today, including verification and password reset, is sent by Supabase. | Email address, message content, delivery events | United States |
| Cloudflare, Inc. | Turnstile, the check that tells a person apart from a bot on the sign-up and sign-in forms. | IP address, request metadata, browser signals collected by the challenge | United States, global edge network |
| Google LLC | Google sign-in, where you choose to use it, for authentication only. | Email address, Google account identifier, basic profile fields | United States |
Your account, your content and your briefs are stored and processed in the United States. The exception is the network layer: hosting and the Cloudflare bot check both run on global edge networks, so request metadata such as your IP address may be handled at an edge location outside the United States before the request reaches us. Pocky is offered to customers in the United States only, so we do not currently rely on standard contractual clauses or any other cross-border transfer mechanism.
Changes to this list
We will publish an update here at least 30 days before a new subprocessor starts processing customer data. If you want to be told directly rather than checking this page, email ops@usepocky.com and we will add you to the notification list.
If you object to a new subprocessor on reasonable data-protection grounds, tell us within the notice period. If we cannot offer an alternative, you may cancel your subscription and we will refund the unused portion of the period you have already paid for. That is an exception to the usual no-refund rule in the Refund and Cancellation Policy.
We may engage a replacement subprocessor without advance notice where an existing one fails or terminates service unexpectedly, and we will update this page as soon as we do.
Change log
- August 16, 2026 Initial publication.