Subprocessors
Last updated November 10, 2026
These are the outside providers that our website and scan backend use today. Each one gets only the data it needs for its job.
| Provider | Purpose | Data involved | Location |
|---|---|---|---|
| Lovable | Hosts the website. Offers Sign in with Lovable. | Page requests (IP address, browser details). For Lovable sign-in: account identifier and email. | See provider |
| Lovable Cloud | Backend for sign-in, profiles and enquiries. | Account identifier, email, display name, company, website. Enquiry name, email, website and message. | See provider |
| Supabase | Database and server functions for the scan backend: scans, member features, search connections, API keys, Ask AI and the MCP server. | Account identifier and email, scan results, tracked prompts and AI answers, chat messages, connected account emails and site totals, encrypted refresh tokens, API key hashes, salted IP hashes. | See provider |
| Cloudflare | Network in front of whywontai.com, the scan Worker. | IP address, browser and device details, request data, the addresses you scan. | See provider |
| Google sign-in, optional read-only Search Console and Analytics connections, Google Analytics 4 on public pages after consent, and Google Fonts. | Google account identifier and email, site-level daily totals, public page views after consent, IP address for font requests. | See provider | |
| Microsoft | Optional Bing Webmaster Tools connection. | Microsoft sign-in, verified site list, site-level daily clicks, impressions and position. | See provider |
| OpenAI | ChatGPT answers for AI visibility prompt checks on paid plans. | The buyer questions you track. Your brand and site names appear in the answers we check. | See provider |
| Perplexity | Perplexity answers for AI visibility prompt checks on paid plans. | The buyer questions you track. Your brand and site names appear in the answers we check. | See provider |
| Google (Gemini) | Gemini answers for AI visibility prompt checks on Pro and Agency plans. | The buyer questions you track. Your brand and site names appear in the answers we check. | See provider |
| Anthropic | Claude answers for Ask AI questions and short text jobs in the scan backend, such as product summaries. Ask AI also runs web search and page fetches through Anthropic's server-side tools, so Anthropic performs those searches and fetches. | Your Ask AI questions and the page or report text needed to answer them. For a web search or a page fetch, the search query and the address of the public page. No card or password data. | See provider |
| Ahrefs | Domain Rating lookup shown in the scan report. | The domain of the scanned site only. | See provider |
| Stripe | Payments: Checkout, the billing portal and signed billing events. | Name, email, billing details and card details entered on Stripe pages, plan and invoices. We never see the card number. | See provider |
| GitHub | GitHub App that opens fix pull requests on paid plans. | The repositories you choose, GitHub account and installation identifiers, the files a pull request changes. | See provider |
| Resend | Sends report emails and follow-ups from the scan backend. | Recipient email, report contents, unsubscribe link. | See provider |
01Locations
We write United States only when a provider's public documents say so. Otherwise we write See provider. Check that provider's own privacy and data processing pages.
02Changes
We will email paying customers at least 30 days before we add or replace a subprocessor. You can object during that time. The Data Processing Addendum explains how. Questions: Mitchell@whywontai.com.