In short
- Today four providers receive personal data: Vercel, which hosts this website, Telegram, which delivers demo requests to our team, Microsoft, for Clarity visit replays, and Google, for Google Analytics when a visitor accepts analytics cookies.
- The providers for paid accounts and AI agent runs are chosen but not live yet. Each is marked Planned or Coming later below.
- We email workspace owners and admins at least 30 days before a new provider receives customer personal data.
What a sub-processor is
A sub-processor is a company we use to run Aiscovery that processes personal data, for example to host a page or deliver a message. Each one gets only the data it needs for its job.
Status tells you where things stand. In use: data flows to the provider today. Planned: chosen and built, and switched on when paid accounts open. Coming later: used only by a feature our site marks Coming later.
Our providers
| Provider | What we use it for | Data it receives | Where | Status |
|---|---|---|---|---|
| Vercel | Hosts this website and runs its forms. Will also host the dashboard. | Request details such as IP address, user agent, time and page. Demo requests pass through on their way to Telegram. Anonymous page analytics only when analytics are on. | United States, with pages served from Vercel's global network | In use |
| Telegram | Delivers demo requests to our team's private channel. | Name, work email, store website, optional note, the page you came from and the time. | Telegram's data centers | In use |
| Microsoft | Microsoft Clarity: visit replays and heatmaps of this website, only for visitors who accept analytics cookies. | Clicks, scrolling, mouse movement and page content with form fields masked, page address, IP address, browser and device details. | United States | In use |
| Google Analytics: counts visits to this website, where they come from and demo requests, only for visitors who accept analytics cookies. | Pages visited with query strings removed except campaign tags, the referring page, browser, device and approximate location, a random cookie ID, and button clicks with fixed labels. Google uses the IP address for location and doesn't store it. | United States and other countries where Google operates | In use | |
| Stripe | Payments, invoices, tax calculation and the billing portal (Manage billing). | Billing email, name and address, payment method (held by Stripe, never by us), subscription and invoice data, and your acceptance of the Terms. | United States and other countries where Stripe operates | Planned |
| Cloudflare | Turnstile bot protection on the free check and the form before checkout. | IP address, user agent and the browser signals the challenge needs. | Cloudflare's global network | Planned |
| OpenAI | AI agent runs with GPT-6 Luna, Ask Aiscovery, and the AI check of task results. | Task instructions, public page text from your store, masked step screenshots, page addresses, and your Ask Aiscovery questions with the results needed to answer them. | United States | Planned |
| AI agent runs with Gemini and the AI check of task results, through the Gemini API. | Task instructions, public page text from your store, masked step screenshots and page addresses. | United States and other countries where Google operates | Planned | |
| Anthropic | Claude agents and checkout rehearsal. | Task instructions, what the agent sees on the page, masked step screenshots and page addresses. | United States | Coming later |
| DataForSEO | AI visibility add-on: answers from ChatGPT search, Google AI Overviews and Gemini. | The prompts you choose to monitor, which can name your brand and competitors, plus a market and language. | Confirmed before the add-on opens | Coming later |
| Bright Data | AI visibility add-on: Perplexity answers. | The prompts you choose to monitor and a country. | Confirmed before the add-on opens | Coming later |
Site checks call no AI model. Model providers receive data only when you run an AI agent task, ask Ask Aiscovery a question, or a task result gets the AI check.
Providers not chosen yet
These services don't run in production yet. We name each provider here once it is chosen, and before it receives any customer data.
- Hosting for the API, workers and database: All product data.
- Screenshot storage: Masked step screenshots.
- Transactional email: Your email address, the email's content (sign-in, invitations, results, alerts) and delivery status.
- Support inbox: Your support messages and the workspace, website and check IDs the dashboard attaches.
- Status page: Your email, only if you subscribe to updates.
How AI model providers handle your data
- We use only their business APIs, whose terms don't let them train their models on our requests. We don't use your data to train models either.
- Agents that run in our browser see only masked step screenshots. We hide form fields, embedded frames and text that looks like an email address, phone number, card, account or order number before a screenshot leaves our browser.
- For OpenAI models and Gemini computer use, we ask the provider not to store responses. The Gemini agent keeps its session at Google while it runs; we delete it when the run ends, and Google deletes it after 7 days at the latest. Providers may also keep requests for a limited time to detect abuse, under their own API terms.
- Coming later: GPT Work runs in OpenAI's own browser, which takes its own screenshots that we can't mask, and OpenAI keeps the session until we delete it after the run. Claude agents run through Anthropic, which keeps a record of each session.
What isn't on this list
Software we run ourselves, such as our sign-in library and the browser our agents use, doesn't send your data to another company, so it isn't a sub-processor. Our website fonts are served from our own domain.
When you pay, Stripe also acts on its own account for things like fraud prevention, under its own privacy policy.
Changes to this list
Before a new or replaced provider receives customer personal data, we update this list and our Privacy Notice, and we email workspace owners and admins at least 30 days before the change. Customers may object as described in our Data Processing Addendum.
Questions about a provider: privacy@aiscovery.io.