Legal
Sub-Processor List
Effective Date: January 1, 2026 · Last Updated: October 18, 2026
Overview
Onederous Inc. ("Onederous") uses the third-party sub-processors listed below to assist in providing the Onederous platform and related services. A "sub-processor" is a third-party entity that processes personal data on behalf of Onederous in connection with delivering the Service to you.
This list is maintained separately from our Privacy Policy and Terms of Service so that it can be updated as our sub-processors change. For our complete data handling practices, please see our Privacy Policy and Terms of Service.
Current Sub-Processors
AI Processing
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Anthropic, PBC | AI model inference — powers the AI agents that process Customer Content and generate Outputs | Customer Content (brand briefs, strategic inputs, uploaded documents); conversation and workflow data sent to AI agents for processing | United States |
| Google LLC | AI image generation — generates images used in AI-produced Outputs | Image generation prompts derived from Customer Content (brand strategy context) | United States |
Cloud Infrastructure and Hosting
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Lovable Technologies AB | Application hosting, deployment, and content delivery | IP addresses; request metadata; static assets; application code execution | Sweden (with global infrastructure) |
| Supabase, Inc. | Database hosting, authentication, edge functions, and backend services (hosted on Lovable cloud infrastructure) | Account information; Customer Content; Outputs; usage data; authentication tokens | United States (AWS infrastructure, managed via Lovable) |
| Vercel Inc. | Website hosting, content delivery and network services (onederous.ai) | IP addresses; request metadata; request logs; data in transit | United States (with global edge network) |
Brand and Media Services
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Brandfetch ApS | Brand data retrieval (logos, colors, fonts) for user-submitted brands | Brand names and URLs submitted by users as part of Customer Content | Denmark |
| Unsplash, Inc. | Stock image search for use in AI-generated outputs | Search queries derived from Customer Content (brand strategy context) | United States |
Web Scraping and Document Processing
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Firecrawl (Mendable, Inc.) | Web page scraping and research for brand analysis; image search | URLs submitted by users as part of Customer Content; search queries | United States |
| CloudConvert GmbH | Document format conversion (e.g., PPTX to PDF) | Uploaded documents and generated files containing Customer Content | Germany |
Scheduled Tasks and Monitoring
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| cron-job.org (Benjamin Scherer) | Scheduled task execution (triggers periodic system checks via edge functions) | No personal data directly processed; triggers authenticated API calls to Onederous backend | Germany |
Authentication
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Google LLC | SSO authentication provider (when users choose to sign in with Google) | Name; email address; Google account identifier | United States |
Payment Processing
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Stripe, Inc. | Subscription billing and payment processing | Billing name; payment method details (card number handled by Stripe, not stored by Onederous); transaction amounts and dates; billing address | United States |
Analytics
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Google LLC (Google Analytics 4) | Website usage analytics | Usage data; page views; device and browser metadata; cookie identifier; IP address (not stored) | United States |
| Google LLC (Google Analytics) | In-app usage analytics (user behavior within the platform) | Usage patterns; feature interactions; session data; internal account identifier; account category | United States |
| PostHog, Inc. | Product analytics: usage events and heatmaps on the website and in the app, and session replays in the app for accounts that have agreed | Usage events; cookie identifier; IP address; in the app, email address, account identifier, and session replays (passwords and payment details are never captured) | United States |
The sub-processors PostHog itself uses are listed at posthog.com/subprocessors.
Email and Communications
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Plus Five Five, Inc. (Resend) | Transactional email delivery (account alerts, password resets, receipts), newsletter delivery, and with consent, marketing communications | Email address; name; email engagement data (opens, clicks) | United States |
| HubSpot, Inc. | Website newsletter signups, subscription confirmation, and marketing email delivery | Email address; the web page a signup came from; email engagement data (opens, clicks) | United States |
Internal Business Tools
These providers do not power the Service and do not process Customer Content. They hold internal business records that can include personal data about customers, prospects and website visitors.
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Notion Labs, Inc. | Internal workspace — meeting notes, action items, product roadmap and business records | Names; email addresses; company names; meeting notes and action items that may refer to customers and prospects | United States |
| GitHub, Inc. | Private source-code and documentation repositories for the platform and the website | Names and email addresses appearing in project documentation, changelogs and commit history; testimonial names and photographs published with permission | United States |
| Fathom Video, Inc. | Recording, transcription and summarization of meetings, including calls with customers and prospects | Names; email addresses; meeting audio, video, transcripts and summaries | United States |
Data Processing Principles
All sub-processors listed above are bound by contractual obligations that require them to:
- Process personal data only as instructed by Onederous and only for the purposes described above;
- Implement appropriate technical and organizational security measures;
- Not use personal data for their own purposes, including model training (see our Privacy Policy, Section 3, for our AI training commitments);
- Assist Onederous in fulfilling data subject rights requests;
- Delete or return personal data upon termination of the service relationship;
- Notify Onederous promptly of any data breach.
One exception, disclosed for transparency. Fathom Video, Inc. may use de-identified meeting content to improve its own artificial-intelligence models unless the account holder opts out of that training in their Fathom settings, which we require for our team's accounts. This does not involve Customer Content, which no sub-processor may use to train AI models (see our Privacy Policy, Section 3).
Sub-Processor Change Notifications
We use commercially reasonable efforts to update this list within 30 days after a new sub-processor begins processing personal data.
To receive notifications when we materially update this Sub-Processor List (e.g., adding a new sub-processor or replacing an existing one), you may:
- Email privacy@onederous.ai with the subject line "Subscribe to Sub-Processor Updates"
- Check this page periodically for updates (the "Last Updated" date at the top of this page will reflect the most recent change)
If you have a legitimate objection to a new sub-processor under GDPR, please contact us at privacy@onederous.ai and we will work with you to find a reasonable resolution, which may include alternative configurations or, if no resolution is possible, termination of the affected services with a pro-rata refund.
Previous Sub-Processor Changes
Newest first.
| Date | Change | Details |
|---|---|---|
| October 18, 2026 | Updated | Vercel Inc. row describes its services and data more fully |
| October 17, 2026 | Replaced | Squarespace, Inc. (website hosting) replaced by Vercel Inc., which hosts onederous.ai |
| October 17, 2026 | Added | PostHog, Inc. — product analytics and session replays in the app |
| October 17, 2026 | Added | HubSpot, Inc. — website newsletter signups and marketing email |
| October 17, 2026 | Added | Notion Labs, Inc., GitHub, Inc. and Fathom Video, Inc. — internal business tools |
| October 17, 2026 | Removed | ZenLeads Inc. (Apollo.io) — website visitor identification and contact enrichment; no longer used, and the data we had supplied to it was deleted |
| October 17, 2026 | Updated | Google Analytics rows — data described as cookie and account identifiers; IP addresses are not stored |
Contact
For questions about this Sub-Processor List or our data processing practices, please contact:
Onederous Inc.
Email: privacy@onederous.ai
1650 Wewatta St, 2102
Denver, CO 80202, USA
This document is maintained by Onederous Inc. and was last reviewed on October 17, 2026.