Current sub-processors
As of the date above, we use the following providers:
| Provider | Purpose | Data handled | Region |
|---|---|---|---|
| Google Cloud Platform | Application hosting, managed Postgres, object storage, Vertex AI / Gemini for intelligence generation. | Account data, crawled page content, generated intelligence, application logs. | US / EU |
| Firebase (Google) | Authentication: sign-up, sign-in, password reset, federated identity. | Email, password hash or federated token, sign-in metadata. | US |
| Cloudflare | Edge Worker (bot interception), R2 object storage, KV, CDN, DDoS / WAF, Turnstile form protection. | Request metadata, hashed IP prefixes, served intelligence payloads, Turnstile challenge tokens. | Global edge |
| Stripe | Subscription billing, invoicing, payment-method tokenization. | Billing contact, payment-method token, invoice history. Card data stays with Stripe. | US / EU |
| HubSpot | CRM, sales and marketing communications, contact / demo form handling. | Name, work email, company, message content, marketing-consent state. | US / EU |
| Google Analytics 4 + Google Tag Manager | Marketing-site traffic analytics and conversion measurement (ooky.ai only: never inside the product). | Pseudonymous visitor IDs, page views, referrer, device metadata. | US |
| Transactional email provider | Verification, password-reset, billing receipts, product and service notifications. | Email address, message content, delivery metadata. | US / EU |
Infrastructure vs. optional integrations
GCP, Firebase, Cloudflare, Stripe, and the transactional email provider are infrastructure: the product cannot run without them. Google Analytics 4 and HubSpot are optional marketing tools that only process visitor data with cookie consent on the ooky.ai marketing site. None of them run inside the authenticated product.
International transfers
Transfers out of the EU/UK rely on the EU Standard Contractual Clauses (with the UK addendum) and the EU-US Data Privacy Framework where the provider is self-certified. The full list of clauses in effect is available in our DPA.
Change log
- 2026-04-24: Initial sub-processor list published.
Questions
Email hello@ooky.ai with any questions about a specific sub-processor, their data handling, or to request a signed DPA.