Subprocessors
Last updated: October 9, 2026
These providers process personal data in order to deliver Fanflet. We put a data protection agreement in place with each of them. This page is the current list. A link in the last column opens that provider's own terms. Fanflet's own Data Processing Addendum is at fanflet.com/legal/dpa.
We update this page at least 30 days before a new provider starts handling personal data. To subscribe to an email alert when the list changes, email privacy@fanflet.com with the subject line "Subprocessor alerts." You may object to a new provider on reasonable data-protection grounds during that notice period. The objection process is in the Data Processing Addendum.
Privacy questions: privacy@fanflet.com.
| Provider | Purpose | Personal data | Where it is processed | Data protection terms |
|---|---|---|---|---|
| Supabase, Inc. | Database, sign-in, file storage, and the email hook | Account details, speaker content, uploaded files, subscriber emails, survey answers and ratings, sponsor accounts and leads, analytics events, privacy request records | United States (AWS us-east-1, N. Virginia) | supabase.com/legal/dpa |
| Vercel Inc. | Website and app hosting, serverless functions, content delivery, cookie-free web analytics, bot protection, scheduled jobs, and AI request routing | Data sent to and from the app, IP addresses, request logs, browser details, and the survey answers described under TypeSafe AI when a request goes through the AI Gateway | United States. The public site is served from the Washington, D.C. region. Some requests pass through servers closer to the visitor | vercel.com/legal/dpa |
| Cloudflare, Inc. | Encrypted backup storage, DNS, CAPTCHA on contact forms, page rendering for profile imports, and inbound mail routing | Database backups, copies of uploaded files, visitor IP address and browser signals on protected forms, and public profile pages a speaker asks us to import | Backup storage is in Eastern North America. CAPTCHA and page rendering run on Cloudflare's global network | cloudflare.com/cloudflare-customer-dpa |
| GitHub, Inc. | Source hosting and the automated jobs that create backups | Database contents and uploaded files, held on a GitHub-hosted runner while a backup runs | GitHub-hosted runners. GitHub chooses the runner region for each job | GitHub Data Protection Agreement |
| Resend, Inc. | Transactional email | Recipient name and email address, email content, and delivery events | United States (Amazon SES, us-east-1) | resend.com/legal/dpa |
| Inngest, Inc. | Background jobs such as digests, scheduled deletion, and privacy-request alerts | Record identifiers and the inputs a job stores in its run history, which can include a name, an email address, or survey text | Inngest's United States cloud | inngest.com/security |
| Stripe, Inc. | Payments and subscription billing | Name, email, billing address, payment card details (held by Stripe), invoices, and subscription status | United States | stripe.com/legal/dpa |
| Twilio Inc. | The one-time text for the SMS bookmark feature | Phone number and the message text (fanflet title and link) | United States | Twilio Data Protection Addendum |
| PostHog, Inc. | Product analytics, only after cookie consent where consent is required. Session replay only inside signed-in dashboards, with form inputs hidden | Signed-in user id (not an email address), pages viewed, clicks, device and browser, approximate location from the IP address, and dashboard session recordings | United States (PostHog US Cloud) | posthog.com/dpa |
| Functional Software, Inc. (Sentry) | Error monitoring | Error details, page address, browser, and operating system. Default personal-data collection is turned off in our configuration | United States (Sentry US) | sentry.io/legal/dpa |
| Anthropic, PBC | The writing assistant (Fannie) and short summaries in analytics digests | Text a speaker types or asks the assistant to rewrite, fanflet copy, and summary counts | United States | anthropic.com/legal/data-processing-addendum |
| TypeSafe AI | Suggestions for which open-text attendee comments a speaker might feature. Requests go through Vercel's AI Gateway. TypeSafe acts as a processor | Open-text survey answers, an optional display name, star rating, fanflet title, and question text | Processed through Vercel AI Gateway under TypeSafe's data processing terms, which include EU Standard Contractual Clauses | typesafe.ai/legal/data-processing. TypeSafe's own subprocessors are listed at trust.typesafe.ai/subprocessors |
| Google LLC (Google Workspace) | Company email, including support and privacy-request correspondence | Whatever a customer or attendee sends us by email | Google Workspace. Mail follows the data-region setting on the Workspace account | Google Workspace Data Processing Amendment |
Google Tag Manager, Google Analytics, and the Meta pixel measure Fanflet's own marketing. They load only on Fanflet's own marketing pages, and only after cookie consent. They do not load on a speaker's public pages. Meta and Google handle that information under their own terms. They are not in the table above.
A customer who connects HubSpot, Zapier, Google sign-in, or their own AI assistant directs that transfer. Those services are not Fanflet subprocessors.
Questions about this policy? Contact us or email support@fanflet.com.