Subprocessors and Third-Party Services
This page lists every company that receives data about SelfScale members, what each one does for us, what it receives and where it says it processes data. It is part of our Privacy Policy. The list is built from a vendor registry, and an automated check compares that registry with our code on each proposed change and flags any vendor that is not on it. We update this page when we add or remove a vendor.
Questions, or want to be told about changes? Email support@selfscale.app.
Service providers that process member data for us
These companies host, store, send or generate content with your data on our behalf.
| Company | What it does for us | Data it receives | Where |
|---|---|---|---|
| Amazon Web Services DPA | S3 write-once audit log export (SelfSecure) | security audit events, which can include member ids and IPs | Customer-selected AWS Region (DPA s.12.1) |
| Anthropic DPA | Text generation (Claude models) | prompts containing member drafts, voice samples, sources and profile details | Not stated by the vendor |
| Backblaze B2 | Off-site database backups | full database dumps | Not stated by the vendor |
| Browserless | Hosted headless browser for Skool checks and re-sign-ins | Skool session and pages loaded | Primarily United States via AWS, DigitalOcean and Supabase (trust page, paraphrased) |
| Cloudflare AI Gateway | Allowlisted as a future model gateway | prompts, if it is ever enabled | Not stated by the vendor |
| Cloudflare Turnstile DPA | Bot check (CAPTCHA) on sign-up | client signals from the member's browser: IP address, TLS fingerprint, User-Agent, site key | Not stated by the vendor |
| DeepSeek | Model inference when the Vercel AI Gateway routes to it | prompts containing member content | Not stated by the vendor |
| ElevenLabs DPA | Text to speech and voice features (member's own key or platform key) | script text; voice samples | Not stated by the vendor |
| fal.ai DPA | Image, video and audio model inference | prompts; member-uploaded images and media used as references | Not stated by the vendor |
| Fly.io | Carousel and video render workers | carousel slides and member media sent for rendering | Our configured region: Ashburn, United States (code iad) |
| Google AI (Gemini) | Model inference when the Vercel AI Gateway routes to it | prompts containing member content | Not stated by the vendor |
| Google Cloud DPA | Secret Manager (Skool passwords and sessions) and Cloud Storage | encrypted Skool credentials and sessions; stored files and backups | Any country with Google or subprocessor facilities, subject to location settings (Cloud DPA) |
| Groq | Model inference when the Vercel AI Gateway routes to it | prompts containing member content | Not stated by the vendor |
| HeyGen DPA | Avatar video generation (member's own key) | scripts; avatar and voice references | United States on AWS (security page) |
| Hostinger (VPS running n8n) DPA | n8n automations and the founder-alert worker | Skool email for the founder-alert worker; automation payloads | Some Hostinger servers are outside the EU/EEA, such as US, Brazil, Singapore, Indonesia (privacy policy); SelfScale's VPS location not verified |
| Inngest | Background job orchestration (event payloads and step results are stored by Inngest) | event payloads, which can include member ids, emails and content | AWS databases located in the United States (security page) |
| Jina AI (r.jina.ai reader) | Fetches and converts web pages to text for quick create | URLs the member submits | Not stated by the vendor |
| MiniMax | Audio or video model inference | prompts and media sent for generation | Data center in the United States (privacy policy) |
| Mistral AI | Model inference when the Vercel AI Gateway routes to it | prompts containing member content | Not stated by the vendor |
| OpenAI DPA | Text and image generation, embeddings | prompts containing member drafts and sources; images for thumbnails | Varies by subprocessor; regional API endpoints exist (DPA) |
| Perplexity DPA | Web research answers for topics and trends | research queries, which can include member topics | AWS in North America (vendor statement) |
| PostHog DPA | Product usage analytics | user id and properties when identified; product events and page views | United States, or Germany for EU Cloud (privacy policy); SelfScale's code points at us.i.posthog.com |
| Resend DPA | Transactional and product email delivery | email address, name; email content | Primary processing in the United States (DPA s.6.1) |
| Scrapfly DPA | Cloud browser for Skool sign-in and scraping | Skool email and password at sign-in; URLs and pages fetched | Not stated by the vendor |
| SendGrid (Twilio) | Inbound Parse webhook for feedback email | sender email address and email body | Not stated by the vendor |
| Sentry DPA | Error and performance monitoring | error reports with request context; user identifiers if set | United States and other countries where Sentry or its subprocessors operate (DPA s.6.1, paraphrased by the fetch tool) |
| Stripe DPA | Payments, subscriptions and billing portal | name, email, billing address; payment card data (held by Stripe); subscription history | Global, as needed to provide the services (DPA) |
| Supabase DPA | Primary database, authentication and file storage | all member account and content data; sign-in identities; uploaded files | Project region chosen by the customer (DPA cl. 6.1); SelfScale's project region not verified here |
| Twilio DPA | SMS notifications and phone verification (Verify) | phone number; SMS message content | Not stated by the vendor |
| Upstash DPA | Redis for rate limits and caches | rate-limit keys (user ids or IPs) and cached values | Not stated by the vendor |
| Vercel DPA | Hosting, serverless functions, Web Analytics, Speed Insights, AI Gateway (routes model prompts) | all app traffic and request data; page and performance events; model prompts when the AI Gateway is on | Primary processing facilities in the United States (DPA s.13) |
| xAI | Model inference when the Vercel AI Gateway routes to it | prompts containing member content | Not stated by the vendor |
| Zapier | Relays new paid Skool members (Profit Room) to SelfScale's webhook | member email, name and Skool member id | Not stated by the vendor |
Analytics and advertising
These load or receive events only after you allow them in Cookie Settings.
| Company | What it does for us | Data it receives | Where |
|---|---|---|---|
| Google Analytics and Tag Manager | Visit measurement after cookie consent | page views, device and cookie ids | Not stated by the vendor |
| Meta Pixel and Conversions API | Ad measurement | page events; server events may carry hashed identifiers | Not stated by the vendor |
| Rewardful | Referral partner tracking | referral cookie, email of referred customer | Not stated by the vendor |
| Stape (server-side Google Tag Manager) | Server-side GTM container | consented page views and events, IP address, cookie ids | Not stated by the vendor |
| TikTok Pixel and Events API | Ad measurement | page events; server events may carry hashed identifiers | Not stated by the vendor |
| Trustpilot | Review invitations and widget | name and email if review invitations are sent | Not stated by the vendor |
Public-data and research services
We send these services search terms, public handles or public URLs, not your account data.
| Company | What it does for us | Data it receives | Where |
|---|---|---|---|
| Apify DPA | Public social data scraping (profiles, posts, competitors) | member and competitor public handles and URLs | Not stated by the vendor |
| AudienceLab | Audience data enrichment | queries sent | Not stated by the vendor |
| BuzzSumo | Content performance research | topics and URLs queried | Not stated by the vendor |
| Firecrawl | Web page scraping | URLs | United States only, no EU residency (docs) |
| Google search suggestions | Demand research from autocomplete | search terms | Not stated by the vendor |
| Have I Been Pwned (Pwned Passwords) | Breached-password check at sign-up | first 5 characters of the password's SHA-1 hash (k-anonymity) | Not stated by the vendor |
| Simple Icons CDN | Brand logo SVG fetch for thumbnails | brand names requested | Not stated by the vendor |
| Supadata DPA | Video transcripts and social metadata | video URLs, including the member's own | Some subprocessors outside the EEA, mainly the United States |
| twitterapi.io | X (Twitter) public data reads | X handles and post ids | Servers in the United States (privacy policy) |
| Webshare | Proxy network for scraping | requests routed through proxies | United States (privacy policy) |
Platforms you connect
Data goes to these platforms only when you connect them and ask us to read from or publish to them. Their own terms and privacy policies apply.
| Company | What it does for us | Data it receives | Where |
|---|---|---|---|
| Canva | Design attach | designs, token | Not stated by the vendor |
| Claude (MCP connector) | A member connects their own Claude account to the SelfScale MCP server over OAuth; SelfScale redirects the member's browser to Claude's callback with a one-time code | OAuth authorization code, then whatever the member's granted scopes let Claude read or do (read by default; connections, write and spend only when ticked) | Not stated by the vendor |
| Fathom | Meeting import (planned) | API key, meetings | Not stated by the vendor |
| Fireflies | Meeting transcript import (member's own key) | API key, meeting transcripts | Not stated by the vendor |
| Ghost | Post import from the member site (member key) | site URL, Content API key, posts | Not stated by the vendor |
| GitHub | Profile and README import; also the founder roadmap | profile, token, repository text | Not stated by the vendor |
| Google sign-in and YouTube | Sign-in, YouTube channel data and uploads, Google Picker and Calendar | profile, tokens, channel data, uploaded videos | Not stated by the vendor |
| Kit | Newsletter import (member's own key) | API key, newsletters | Not stated by the vendor |
| Sign-in and publishing | profile, access token, posts | Not stated by the vendor | |
| ManyChat | Carousel comment-to-DM handoff | page id, keyword | Not stated by the vendor |
| Meta (Instagram, Facebook, Threads) | Publishing and account data | account ids, tokens, media | Not stated by the vendor |
| Notion | Page import; also the founder roadmap | pages the member grants, token | Not stated by the vendor |
| Publishing | tokens, pins | Not stated by the vendor | |
| Readwise | Highlights import (member token) | token, highlights | Not stated by the vendor |
| Publishing | tokens, posts | Not stated by the vendor | |
| Skool | Community publishing (no sign-in API) | Skool email and password, session, posts | Not stated by the vendor |
| Slack | Member notifications; also founder alerts via webhook | workspace id, bot token, notification text | Not stated by the vendor |
| Substack | Public RSS feed of the member publication | publication URL | Not stated by the vendor |
| Telegram | Alert bot | chat id, username, alert text | Not stated by the vendor |
| TikTok | Publishing | account id, tokens, videos | Not stated by the vendor |
| Wispr Flow | Meeting transcript import | tokens, meeting transcripts | Not stated by the vendor |
| X (Twitter) | Publishing and reads | handle, tokens, posts | Not stated by the vendor |
Content your browser or mail app loads
These serve fonts, images or videos directly to your browser, so they see your IP address and request headers.
| Company | What it does for us | Data it receives | Where |
|---|---|---|---|
| GIPHY | GIF search in the editor | search terms (sent by SelfScale); IP address and request headers of the member whose browser loads the result images | Not stated by the vendor |
| Google Fonts | Web fonts linked from member emails, the landing page and CSS | IP address, user agent and time of each email open or page view | Not stated by the vendor |
| LinkedIn media CDN | LinkedIn profile and post images shown in the app | IP address and request headers of the viewer | Not stated by the vendor |
| Loom | Welcome video embed and thumbnails in the dashboard, plus oEmbed lookups for Loom links | IP address and request headers of each member who opens the dashboard; Loom video URLs | Not stated by the vendor |
| Pexels | Stock video search | search terms (sent by SelfScale); IP address and request headers of the member whose browser loads the result images | Not stated by the vendor |
| Public media CDNs (Meta, TikTok, X, Google, GitHub, Vimeo) | Public thumbnails, avatars and videos shown in the app, some re-hosted server-side | IP address and request headers of the member whose browser loads thumbnails and videos; public media URLs fetched by SelfScale servers | Not stated by the vendor |
| Tenor (Google) | GIF search in the editor | search terms (sent by SelfScale); IP address and request headers of the member whose browser loads the GIF results | Not stated by the vendor |
| YouTube embeds and thumbnails (Google) | Landing-page video embed and YouTube thumbnails shown in the app | IP address and request headers of the viewer | Not stated by the vendor |
Tools our team uses to run SelfScale
These may hold member contact or account details while we support you or handle incidents.
| Company | What it does for us | Data it receives | Where |
|---|---|---|---|
| Attio DPA | Sales CRM | member and lead contact details, deal stages | Hosted on Google Cloud Platform (location unverified) |
| Cal.com | Onboarding-call booking (waitlist invite email, Profit Room onboarding) | name, email and answers the invitee types | Not stated by the vendor |
| Calendly | Strategy-call booking link | whatever the person types on Calendly | Not stated by the vendor |
| GitHub (SelfScale roadmap and incidents) | Issues created in SelfScale's own repository | incident and feature-request text | Not stated by the vendor |
| Google Sheets (founder reports) | Founder reporting sheets (service account) | aggregate or member rows written to a founder sheet | Not stated by the vendor |
| Linear DPA | Incident and issue tracking | incident details, which can name members | Primary processing in the United States |
| Slack (SelfScale alerts) | Founder and backup alerts posted to SelfScale's own Slack | alert text, which can include member email and feedback | Not stated by the vendor |
| UptimeRobot DPA | Uptime monitoring | public URLs only | Not stated by the vendor |