Legal
Sub-processors
Last updated November 1, 2026
A sub-processor is a company PixelClaw relies on that handles personal data on our behalf. This page lists every one of them, what it does for us, the personal data it sees, where it works, and the safeguard that lets data from the EU, EEA, UK and Switzerland reach it. It is the list our Privacy Policy refers to.
Where your data lives
- Database: United States (Virginia). Accounts, blogs, posts, comments and settings are stored here.
- Application: Netherlands. The server that builds the pages and runs the AI, publishing and analytics work.
- Pictures and uploads: Cloudflare R2 object storage, served from media.pixelclaw.ai.
Who handles personal data
Providers a workspace connects with its own keys, such as an AI vendor or a Firecrawl account, work under that workspace's own agreement with the provider and are not listed here.
Supabase
Supabase, Inc., United States
- What it does
- The database, sign-in and encrypted secrets behind the whole service.
- Personal data
- Account email and name, sign-in records, blog memberships, posts and pages, comments with the commenter's name and email, Search Console data, encrypted API keys, the activity log.
- Where
- United States (Virginia)
- Safeguard
- Standard Contractual Clauses
Hostinger
Hostinger International Ltd., Cyprus
- What it does
- The server that runs the application and its short-lived cache.
- Personal data
- Everything in a request while it is handled, web server logs with IP addresses kept for a few days, a short-lived cache of blog data.
- Where
- Netherlands
- Safeguard
- Based in the European Union
Cloudflare
Cloudflare, Inc., United States
- What it does
- Network delivery, protection and domain management for pixelclaw.ai and every custom domain; storage for uploaded pictures.
- Personal data
- Visitor IP addresses and request details while pages are delivered; uploaded media files.
- Where
- Global network; media files in Cloudflare R2
- Safeguard
- EU-US Data Privacy Framework
Resend
Resend, Inc., United States
- What it does
- Sends sign-in links, comment confirmations and account notices.
- Personal data
- The recipient's email address and name, and the email's content.
- Where
- United States
- Safeguard
- Standard Contractual Clauses
Stripe
Stripe, Inc., United States, and Stripe Payments Europe Ltd., Ireland
- What it does
- Payments, subscriptions and invoices.
- Personal data
- Billing name and email, payment details (never stored by PixelClaw), invoices.
- Where
- United States and Ireland
- Safeguard
- EU-US Data Privacy Framework
Google LLC, United States, and Google Ireland Ltd., Ireland
- What it does
- Google sign-in, Search Console data, the Indexing API, and map embeds on hosted blogs.
- Personal data
- The Google account email at sign-in; Search Console data for a connected property; a reader's IP address when a hosted page shows a map.
- Where
- United States and the European Union
- Safeguard
- EU-US Data Privacy Framework
Concord
Concord Technologies, Inc., United States
- What it does
- The consent banner and privacy center on pixelclaw.ai itself; never on a customer's blog.
- Personal data
- The privacy choice a visitor makes on pixelclaw.ai, when it was made, and the technical details of that visit Concord needs to record it.
- Where
- United States
- Safeguard
- Standard Contractual Clauses
OpenRouter
OpenRouter, Inc., United States
- What it does
- Runs AI writing, research and translation when a workspace uses PixelClaw's own AI credits.
- Personal data
- The content it is asked to work on: briefs, outlines, article text, brand voice. No account data.
- Where
- United States
- Safeguard
- Receives content only, never account data
Firecrawl
Firecrawl (Mendable AI, Inc.), United States
- What it does
- Reads public web pages and search results for research, competitor checks and rank tracking.
- Personal data
- Public page content, web addresses and keywords. No account data.
- Where
- United States
- Safeguard
- Receives content only, never account data
DataForSEO
DataForSEO OÜ, Estonia
- What it does
- Returns search-volume estimates when an editor explicitly requests them; available only when configured.
- Personal data
- The selected keywords or questions, country and language. No account data or Search Console records.
- Where
- Estonia-based provider; infrastructure providers in Germany and the United States
- Safeguard
- Receives content only, never account data
TypeSafe AI (Jev)
TypeSafe AI, Inc., United States
- What it does
- Assesses keyword intent and relevance to the approved business profile; optional draft reviews use a separate setting.
- Personal data
- Search text, country and language, a limited approved business summary, and existing public search titles and URLs. Draft text only when draft reviews are separately enabled. No account identifiers, credentials or Search Console metrics.
- Where
- United States
- Safeguard
- Receives content only, never account data
Changes to this list
Before a new provider handles personal data, we add it here and email every workspace owner at least 30 days ahead. An owner who objects on data-protection grounds can end their subscription without penalty if we cannot find a way around the objection.
Questions
Write to [email protected]. Our customer data processing agreement is available on request.