Cleotic is run by General Dataworks DWC-LLC. When a customer uses Cleotic, we process personal data for them under our Data Processing Agreement (DPA). The companies below help us do that. Each one gets only the data it needs for its job.
Current sub-processors
| Sub-processor | What it does | Customer personal data it receives | Location and transfer safeguard |
|---|---|---|---|
| Railway | Hosts the application, database and backups | All customer data | Netherlands (Amsterdam)DPF; SCCs with the UK Addendum |
| Vercel | Hosts the web app | Data passing between the web app and the API, and request logs | US (Washington, D.C. and San Francisco), UK (London) and India (Mumbai). Each request runs in the nearest of these.DPF; SCCs with the UK IDTA |
| Cloudflare | Carries requests to our tracking and connected-agent (MCP) addresses, t.cleotic.ai and mcp.cleotic.ai | Each request to those addresses, including the sender’s IP address, user agent and other headers, and what the request carries | US. Each request passes through its data centre nearest the sender, worldwide.DPF; SCCs with the UK Addendum |
| WorkOS | Sign-in, single sign-on, and the user and organisation directory | Names and email addresses of authorised users, and sign-in records | USSCCs with the UK Addendum |
| OpenRouter | Routes requests to AI models from OpenAI, Anthropic, Google, Perplexity, xAI and others | Prompts, brand facts, page content, AI answers and drafts, including any names in them. In Content Studio, each team member’s name, or email address if no name is set. | US. Model providers are in the US and elsewhere.SCCs with the UK Addendum |
| DataForSEO | Search results and Google AI Overviews for tracked prompts | Prompt text | Estonia (an EU company; it does not publish where its servers are)None needed: EU company |
| ScrapingBee | Fetches a page through a proxy when a direct fetch is blocked | Page addresses and page content | France (Paris), with some of its own sub-processors in the USSCCs with the UK IDTA |
| PostHog | Product analytics and session recordings in the web app | Usage events and page addresses; the name and email address of each signed-in user, and their organisation’s name and plan; errors; and session recordings that mask all text and inputs | EU (Frankfurt, Germany)DPF; SCCs with the UK IDTA |
| Resend | Sends weekly emails, scan results and the reports customers send | Recipients’ email addresses and names, and the email contents | USDPF; SCCs with the UK Addendum |
| Loops | Sends account emails and holds our email contact list | Names and email addresses of authorised users, and account events such as the names and domains of brands they add | USDPF; SCCs |
| TypeSafe | Classifies AI answers and the pages they cite | AI answers about the customer’s brand, their prompts, and the titles and summaries of cited pages, including any names in them. TypeSafe may keep and reuse what it derives from them; see below. | USSCCs with the UK Addendum |
Every request we send to OpenRouter tells it to use only model providers that do not collect the data they receive. OpenRouter does not store prompts by default.
Under its terms, TypeSafe may keep and reuse what it derives from the AI answers we send it, such as classifications and learnings, with no time limit. It does not train models on them without consent.
DataForSEO’s terms set no time limit for deleting the prompt text we send it.
Each sub-processor is bound by a data processing agreement. We have signed agreements with Railway and PostHog, and the others’ apply under their terms. Transfers out of the EEA and the UK rely on the safeguard shown for each one: the EU-US Data Privacy Framework (DPF), or the European Commission’s Standard Contractual Clauses (SCCs) with the UK Addendum or the UK International Data Transfer Agreement (IDTA).
Services that receive no customer data
We also use these services to run our own business. They don’t receive the data customers bring to Cleotic, so they are not sub-processors. Our Privacy Policy explains what they do receive.
- Stripe: payments and invoices.
- ClickTerm: records who accepted our terms and when.
- c15t, run by Inth: the cookie banner on our website.
- HubSpot: demo requests and call booking.
- Contentful: the content of our blog.
- Google Tag Manager, Google Analytics, Microsoft Clarity, Reddit and X: analytics and advertising on our website.
- GitHub: hosts updates for our CLI.
Changes to this list
We tell customers at least 30 days before a new sub-processor starts processing their data. We update this page and email each customer’s account admins. A customer can object to the change during those 30 days, as the DPA sets out.
Contact
Questions about this list or the DPA: email privacy@cleotic.ai.