HyperFound — Sub-processors
Last updated: 29 September 2026.
HyperFound is operated by Tom Marx, autónomo (NIE Y7134879V), trading as "HyperFound", established in Spain. We act as data controller for account, billing, usage, and marketing data, and as processor for customer-site visitor data and other Customer Content. We engage the sub-processors below to deliver the Service, and we notify customers at least 30 days before a new sub-processor begins processing Customer Personal Data; customers may object as set out in the DPA. Questions: tom@hyperfound.ai.
A. Infrastructure (process all data categories, in transit/at rest)
| Sub-processor | Entity / country | Purpose | Processing location | Transfer mechanism |
|---|---|---|---|---|
| Supabase | Supabase Inc. (US) | Database, authentication, storage, and request-limit counters (which hold IP addresses) | AWS (EU region) | SCCs (2021/914 Mod 2) |
| Vercel | Vercel Inc. (US) | Application + API hosting, cron, and bot protection (BotID) on two forms | AWS / Azure / GCP | SCCs (Mod 2 + 3), UK IDTA, Swiss |
| Upstash | Upstash, Inc. (US) | Workflow queue: carries job data between processing steps, including captured AI-engine answers and brand details | AWS | SCCs + EU-US DPF |
B. Payments
| Sub-processor | Entity / country | Purpose | Processing location | Transfer mechanism |
|---|---|---|---|---|
| Stripe | Stripe Payments Europe Ltd (Ireland) / Stripe, Inc. (US) | Subscription billing & payments | EU + US | SCCs + EU-US DPF |
C. Communications
| Sub-processor | Entity / country | Purpose | Processing location | Transfer mechanism |
|---|---|---|---|---|
| Resend (Plus Five Five, Inc.) | US | Email delivery — transactional, welcome, product and GEO report email — including delivery, bounce and open events | US | SCCs + EU-US DPF |
| Google Workspace | Google Cloud EMEA Limited | Our business email: receives GEO report request notifications and your replies to our emails | Any country where Google or its sub-processors have facilities | Google's Cloud Data Processing Addendum: a transfer framework Google has adopted where one exists, otherwise SCCs |
D. Analytics (our website and app)
| Sub-processor | Entity / country | Purpose | Processing location | Transfer mechanism |
|---|---|---|---|---|
| Google Analytics 4 | Google Ireland Ltd / Google LLC | Website and app usage analytics — cookies only with your consent; cookieless measurement until then | Global | SCCs (P2P) / EU-US DPF |
E. AI inference — providers that process Customer Content
These receive captured AI-engine answers, prompts, brand and competitor names, and related text (which may contain incidental personal data) to produce measurements. None may train its models on Customer Content: OpenAI, Anthropic and xAI by contract; OpenRouter by its data processing agreement, and we route its requests only to model hosts that retain no data.
| Provider | Entity / country | Purpose | Transfer mechanism |
|---|---|---|---|
| OpenRouter | OpenRouter, Inc. (US) | Entity, position and sentiment extraction; claims; prompt classification and clean-up. Routed only to the model hosts DeepInfra, Parasail and OpenInference running DeepSeek V4 Flash — each listed by OpenRouter as a zero-data-retention endpoint for this model | DPA (part of OpenRouter's Terms) with SCCs (Mod 2), UK Addendum, Swiss |
| OpenAI | OpenAI, L.L.C. (US) | Intent and question classification; content scoring | DPA + SCCs/DPF — no training on Customer Content |
| Anthropic | Anthropic Ireland Ltd (IE / US) | Entity classification; content briefs; llms.txt drafts | DPA — no training on Customer Content |
| xAI | X.AI LLC (US) | Brand research (from your brand name and website) | DPA — no training on Customer Content |
F. Competitive-intelligence capture (public web + AI-engine outputs)
| Sub-processor | Entity / country | Purpose | Transfer mechanism |
|---|---|---|---|
| Bright Data Ltd | Israel (+ global egress) | Capture of public consumer AI-engine answers; public Reddit posts and comments for question research; onboarding preview scans | Israel (EU adequacy) / SCCs |
| DataForSEO OÜ | Estonia (EU) | Google SERP, AI Overview and AI Mode answers; ChatGPT answers; "People also ask" questions; keyword data; web search for DeepSeek measurements | EU entity; SCCs/adequacy for onward US sub-processing |
Measured AI engines (not sub-processors of your personal data)
We query the AI engines below to measure brand visibility, with prompts we generate (e.g., "best [industry] tools", "[brand] vs [competitor]") and with prompts you write yourself, which we send exactly as written — so a prompt you write should not contain personal data. We capture their public outputs (directly or via the capture providers in §F): ChatGPT (OpenAI), Microsoft Copilot, Google (Gemini, AI Overviews and AI Mode), Perplexity, Claude (Anthropic), Grok (xAI), and DeepSeek.
DeepSeek is operated from the People's Republic of China. As a measured engine, DeepSeek's own service receives the prompts we measure — including prompts you write — and the web-search results for them; we never route Customer Personal Data to it. Separately, DeepSeek's V4 Flash model processes captured answers for us (§E), run by the model hosts named there through OpenRouter — never on DeepSeek's own service.
Customer-connected integrations (your own accounts — not our sub-processors)
Google Search Console, Google Analytics 4, Slack — you connect these via OAuth; data flows under your agreement with the provider; you control scope and may disconnect at any time. Outbound webhooks deliver to your own endpoint.