Sub-processors

Last updated: 19 May 2026 · v1.0 — effective 19 May 2026

This is the canonical record of every third party that processes Customer Personal Data on PromptSpotter's behalf. It is referenced from our Privacy Policy and the Data Processing Agreement in force with each customer.

We commit to updating this list whenever a sub-processor is added, removed, or has a material change in scope, with at least 30 days' notice to customer administrators via email.

Current sub-processors

Sub-processor	Region	Purpose	Data accessed
Netlify, Inc.	US / EU (edge)	Hosting for backend functions, admin console, and marketing site	All event metadata, admin sessions, marketing-site visits
Turso (ChiselStrike, Inc.)	EU — Frankfurt (primary)	Primary database (libSQL) — event metadata + admin records	All event metadata, customer + admin records
Stripe, Inc.	US / EU	Billing + payment processing (card data held by Stripe, never by us)	Billing contact, billing address, payment instrument tokens
Resend (Drago, Inc.)	US	Transactional email (magic sign-in link, billing notices)	Administrator email addresses only
GitHub, Inc.	US	Source code hosting (production code only — no customer data)	No Customer Personal Data

What about Chrome / the browser?

When the PromptSpotter extension is installed in a user's Chrome browser, the browser itself is part of the user's device — not a PromptSpotter sub-processor. Google's own privacy practices apply to the browser; ours apply only to data that crosses the boundary out of the browser into our backend.

What about the AI tools (ChatGPT, Claude, etc.)?

The AI tools themselves are not PromptSpotter sub-processors. When a user sends a prompt to ChatGPT, the user (and their employing organization) has a separate relationship with OpenAI for that prompt. PromptSpotter does not process or transmit that content — we only see metadata about whether our rules fired.

Notification of changes

Customer administrators are notified by email at least 30 days before a new sub-processor begins processing Customer Personal Data, or before an existing sub-processor's scope materially changes. Customers may object to a proposed change by writing to info@promptspotter.com within the notice period; if we cannot resolve the objection, the customer may terminate the affected subscription on reasonable notice without penalty.

Change history