Legal
Sub-Processor List
Effective Date: January 1, 2026 · Last Updated: May 5, 2026
Overview
Onederous Inc. ("Onederous") uses the third-party sub-processors listed below to assist in providing the Onederous platform and related services. A "sub-processor" is a third-party entity that processes personal data on behalf of Onederous in connection with delivering the Service to you.
This list is maintained separately from our Privacy Policy and Terms of Service so that it can be updated as our sub-processors change. For our complete data handling practices, please see our Privacy Policy and Terms of Service.
Current Sub-Processors
AI Processing
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Anthropic, PBC | AI model inference — powers the AI agents that process Customer Content and generate Outputs | Customer Content (brand briefs, strategic inputs, uploaded documents); conversation and workflow data sent to AI agents for processing | United States |
| Google LLC | AI image generation — generates images used in AI-produced Outputs | Image generation prompts derived from Customer Content (brand strategy context) | United States |
Cloud Infrastructure and Hosting
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Lovable Technologies AB | Application hosting, deployment, and content delivery | IP addresses; request metadata; static assets; application code execution | Sweden (with global infrastructure) |
| Supabase, Inc. | Database hosting, authentication, edge functions, and backend services (hosted on Lovable cloud infrastructure) | Account information; Customer Content; Outputs; usage data; authentication tokens | United States (AWS infrastructure, managed via Lovable) |
| Squarespace, Inc. | Public website hosting (onederous.com) | IP addresses; request metadata; cookie data from website visitors | United States |
Brand and Media Services
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Brandfetch ApS | Brand data retrieval (logos, colors, fonts) for user-submitted brands | Brand names and URLs submitted by users as part of Customer Content | Denmark |
| Unsplash, Inc. | Stock image search for use in AI-generated outputs | Search queries derived from Customer Content (brand strategy context) | United States |
Web Scraping and Document Processing
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Firecrawl (Mendable, Inc.) | Web page scraping and research for brand analysis; image search | URLs submitted by users as part of Customer Content; search queries | United States |
| CloudConvert GmbH | Document format conversion (e.g., PPTX to PDF) | Uploaded documents and generated files containing Customer Content | Germany |
Scheduled Tasks and Monitoring
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| cron-job.org (Benjamin Scherer) | Scheduled task execution (triggers periodic system checks via edge functions) | No personal data directly processed; triggers authenticated API calls to Onederous backend | Germany |
Authentication
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Google LLC | SSO authentication provider (when users choose to sign in with Google) | Name; email address; Google account identifier | United States |
Payment Processing
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Stripe, Inc. | Subscription billing and payment processing | Billing name; payment method details (card number handled by Stripe, not stored by Onederous); transaction amounts and dates; billing address | United States |
Analytics
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Google LLC (Google Analytics 4) | Website usage analytics | De-identified and aggregated usage data; page views; IP address (anonymized where configured); device and browser metadata | United States |
| Google LLC (Google Analytics) | In-app usage analytics (user behavior within the platform) | Usage patterns; feature interactions; session data; anonymized user identifiers | United States |
Email and Communications
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Plus Five Five, Inc. (Resend) | Transactional email delivery (account alerts, password resets, receipts), newsletter delivery, and with consent, marketing communications | Email address; name; email engagement data (opens, clicks) | United States |
Data Processing Principles
All sub-processors listed above are bound by contractual obligations that require them to:
- Process personal data only as instructed by Onederous and only for the purposes described above;
- Implement appropriate technical and organizational security measures;
- Not use personal data for their own purposes, including model training (see our Privacy Policy, Section 3, for our AI training commitments);
- Assist Onederous in fulfilling data subject rights requests;
- Delete or return personal data upon termination of the service relationship;
- Notify Onederous promptly of any data breach.
Sub-Processor Change Notifications
We use commercially reasonable efforts to update this list within 30 days after a new sub-processor begins processing personal data.
To receive notifications when we materially update this Sub-Processor List (e.g., adding a new sub-processor or replacing an existing one), you may:
- Email privacy@onederous.ai with the subject line "Subscribe to Sub-Processor Updates"
- Check this page periodically for updates (the "Last Updated" date at the top of this page will reflect the most recent change)
If you have a legitimate objection to a new sub-processor under GDPR, please contact us at privacy@onederous.ai and we will work with you to find a reasonable resolution, which may include alternative configurations or, if no resolution is possible, termination of the affected services with a pro-rata refund.
Previous Sub-Processor Changes
No changes recorded yet. This section will be updated as sub-processors are added, removed, or replaced.
| Date | Change | Details |
|---|---|---|
| — | — | — |
Contact
For questions about this Sub-Processor List or our data processing practices, please contact:
Onederous Inc.
Email: privacy@onederous.ai
100 W. Imperial Ave. Suite R
El Segundo, CA 90245
This document is maintained by Onederous Inc. and was last reviewed on May 5, 2026.