Sub-processors

Third-party service providers that process customer or visitor data on behalf of CloudWeld LLC. Each is contractually bound to the same data-protection standards we commit to in our Privacy Policy and DPA.

Last updated: 2026-09-03

Change notifications We give customers at least 30 days' notice before adding or replacing a sub-processor that handles customer personal data we process on their behalf. Vendors that handle our own marketing and site-analytics data are listed here when the change takes effect. Subscribe to updates by emailing hello@ooky.ai.

Current sub-processors

As of the date above, we use the following providers:

Provider Purpose Data handled Region
Google Cloud Platform Application hosting, managed Postgres, object storage, Vertex AI / Gemini for intelligence generation. Account data, crawled page content, generated intelligence, application logs. US / EU
Firebase (Google) Authentication: sign-up, sign-in, password reset, federated identity. Email, password hash or federated token, sign-in metadata. US
Cloudflare Edge Worker (bot interception), R2 object storage, KV, CDN, DDoS / WAF, Turnstile form protection. Request metadata, hashed IP prefixes, served intelligence payloads, Turnstile challenge tokens. Global edge
Stripe Subscription billing, invoicing, payment-method tokenization. Billing contact, payment-method token, invoice history. Card data stays with Stripe. US / EU
HubSpot CRM, sales and marketing communications, contact / demo form handling. Name, work email, company, message content, marketing-consent state. US / EU
Google Analytics 4 + Google Tag Manager Marketing-site traffic analytics plus consented server-side signup and paid-subscription conversion measurement; no Google browser tag runs in the authenticated product. Denied-state cookieless measurement signals; after consent, pseudonymous visitor/session IDs, page views, referrer, device and campaign metadata, plus IP address for coarse conversion geography. US
Reddit Ads Consented advertising measurement, campaign attribution, and conversion reporting (signup and paid subscription). Reddit click and browser IDs, hashed email/account ID, IP address, user agent, and conversion metadata including plan value and currency for a purchase. US / Global
Microsoft Advertising Advertising conversion measurement and campaign attribution via the UET tag, which runs in consent mode on the marketing site and inside the authenticated product. Microsoft click id; after consent, UET session/visitor cookies, page and event data, and the signup and contact-form conversion events. No hashed email or account identifiers. US / Global
Transactional email provider Verification, password-reset, billing receipts, product and service notifications. Email address, message content, delivery metadata. US / EU

Infrastructure vs. optional integrations

GCP, Firebase, Cloudflare, Stripe, and the transactional email provider are infrastructure: the product cannot run without them. Google Analytics uses denied-storage cookieless measurement on the marketing site; identifiers and server-side signup conversions require consent. HubSpot receives contact/demo information a visitor deliberately submits even when tracking cookies are declined, while its browser tracking remains consent-gated. Reddit browser and server-side advertising measurement both require consent. Microsoft Advertising's UET tag runs in the same consent mode as Google's: it loads with advertising storage denied and sets nothing until consent is granted. No Google, HubSpot, or Reddit browser tag runs inside the authenticated product; the one exception is the Microsoft UET tag, which also runs on app.ooky.ai in that consent-mode manner so a consented signup can be reported as a conversion.

International transfers

Transfers out of the EU/UK rely on the EU Standard Contractual Clauses (with the UK addendum) and the EU-US Data Privacy Framework where the provider is self-certified. The full list of clauses in effect is available in our DPA.

Change log

  • 2026-09-03: Added Microsoft Advertising (UET) conversion measurement, running in consent mode on ooky.ai and app.ooky.ai, the consented 30-day first-party ooky_attr attribution cookie, and server-side paid-subscription (purchase) conversion reporting to Google Analytics and Reddit for consented accounts.
  • 2026-08-31: Added Reddit Ads conversion measurement and clarified the data used for attribution.
  • 2026-04-24: Initial sub-processor list published.

Questions

Email hello@ooky.ai with any questions about a specific sub-processor, their data handling, or to request a signed DPA.