Legal
Subprocessors
Every third party that touches data on our behalf, what it does, where it processes, and the transfer mechanism. Updated 30 days before any addition.
Draft pending legal review. This document is written to be honest and readable, but it has not yet been reviewed by a lawyer. Questions in the meantime go to support@stacked.app.
Last updated
Every third party that processes data on our behalf is listed here. Each is engaged under a written agreement with obligations at least as protective as our own DPA, and each is assessed before it processes anything.
We give at least 30 days' notice before a new subprocessor starts, by email to workspace owners and by updating this page. Subscribe to changes by emailing support@stacked.app with the subject "subprocessor updates".
Infrastructure
| Subprocessor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Supabase | Primary database, authentication, row-level isolation | EU (Frankfurt) | N/A, EEA |
| Vercel | Application hosting, edge network | EU primary, global edge | SCCs + UK Addendum |
| Cloudflare R2 | Object storage for uploads, renders and exports | EU | SCCs + UK Addendum |
| Upstash | Queues and rate limiting | EU (Frankfurt) | N/A, EEA |
AI model providers
Each of these is contractually prohibited from training on data we send, and retains it only for the short abuse-monitoring window its terms require.
| Subprocessor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Anthropic | Draft generation, classification, summarisation | US | SCCs + UK Addendum |
| OpenAI | Draft generation, embeddings for search and matching | US | SCCs + UK Addendum |
| Deepgram | Speech-to-text for video, audio and voice questions | US | SCCs + UK Addendum |
| Replicate | Image and video rendering models | US | SCCs + UK Addendum |
Communications
| Subprocessor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Resend | Transactional and product email | US | SCCs + UK Addendum |
| Twilio | SMS and WhatsApp, where a tool sends them | US | SCCs + UK Addendum |
Business operations
| Subprocessor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Stripe | Payments, subscriptions, tax calculation, invoices | US and EU | SCCs + UK Addendum |
| PostHog | Product analytics, IP anonymised, EU instance | EU | N/A, EEA |
| Sentry | Error monitoring, with PII scrubbing enabled | EU | N/A, EEA |
| Betterstack | Uptime monitoring and the public status page | EU | N/A, EEA |
| Rewardful | Affiliate tracking and payouts | US | SCCs + UK Addendum |
Publishing partners
Some platforms have no direct API available to an application our size, or require an audit we have not yet completed. Where that is true, posting runs through an approved partner.
| Subprocessor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Ayrshare | TikTok and X posting, until direct API access is approved | US | SCCs + UK Addendum |
We intend to remove this row for each platform as direct access is granted, and we will note it in the changelog when we do.
Not subprocessors
The platforms you connect — Instagram, YouTube, Discord, Shopify, your podcast host, your email provider — are not our subprocessors. When Stacked posts to them, that is you acting on your own account through software you authorised. Your relationship with those platforms is governed by their terms, not ours.
Changes to this page
| Date | Change |
|---|---|
| 2026-09-01 | Initial published list |
Questions
support@stacked.app. If you need a signed DPA naming these subprocessors, ask and you will have one within two business days.