List of processors and data sources
Effective from
This is the list referred to in § 5 of the joint controller arrangement and in section 5 of the Privacy Policy. It has two parts: entities processing data on our behalf and data sources—entities that make public content available to us and do so in their own role, not on our instructions. We notify customers of each change by email 30 days in advance. Data not listed in any row do not leave our servers.
Contents
Hetzner Online GmbH
Role: hosting of servers, database and backups — all service data.
Country: Germany (EEA). Data processing agreement concluded online with the provider.
Stripe Payments Europe, Ltd.
Role: card payments, subscriptions, invoices — customers' billing details, e-mail addresses, amounts and payment history. We never receive card details.
Country: Ireland (EEA). Stripe transfers some data to Stripe, Inc. in the USA under the EU-U.S. Data Privacy Framework and standard contractual clauses. For fraud prevention and regulatory purposes Stripe is an independent controller.
Plus Five Five, Inc. (Resend)
Role: e-mail delivery — recipient addresses and message content, including lead notifications (the author's name and an excerpt of the post).
Country: United States. Transfer basis: EU-U.S. Data Privacy Framework and standard contractual clauses in the provider's data processing agreement.
SMSAPI sp. z o.o.
Role: SMS notifications — phone numbers set by the customer and the notification text.
Country: Poland (EEA).
Functional Software, Inc. (Sentry)
Role: application error monitoring — technical events with personal data stripped, technical identifiers.
Country: events stored in the EU region (Frankfurt); account data in the USA. Transfer basis: EU-U.S. Data Privacy Framework and standard contractual clauses. Retention 90 days.
PostHog, Inc.
Role: product analytics for the panel — events attributed to an organisation identifier, without cookies, with the IP address discarded.
Country: processing in the EU region (eu.i.posthog.com). Basis for any access from the USA: standard contractual clauses.
Calendly LLC
Role: calendar for booking an onboarding call, embedded on the /en/onboarding-call page and loaded only after your consent. It sees what you provide when booking — your name, email address, and selected time — and sets its own cookies in your browser.
Country: United States (Calendly LLC). Transfer mechanism: standard contractual clauses. Without consent, the calendar does not load and no data is sent to Calendly.
IPRoyal (IPRoyal Services FZE LLC)
Role: the proxy infrastructure through which we read public Facebook pages. It sees the addresses of visited pages and traffic volume; connections are encrypted, so it sees neither post content nor customer data.
Country: United Arab Emirates (contracting entity), distributed infrastructure. Basis: standard contractual clauses in the provider's data processing agreement.
Redditapis (operator of redditapis.com) — data source
Role: source of public Reddit content. We send subreddit names and search phrases and receive public posts, comments and profiles of their authors. It does not receive customer data or content other than from public Reddit.
It is not a processor. The provider itself determines how content is collected and states that its team is the controller of data for redditapis.com; we do not enter into a data processing agreement with it under Article 28 GDPR because it does not act on our behalf. Until 6 September 2026, the list described it as a processor — that was an error as to its role, and we are correcting it accordingly.
Contracting entity and country: outside the EEA, in accordance with the provider's terms and conditions. We do not state a transfer basis because we do not send personal data there — we send a subreddit name or a search phrase, while author data flows in the other direction. Receiving data from a source outside the EEA is collection, not a transfer within the meaning of Chapter V GDPR. The assessment of the lawfulness of this source is being prepared; until it is completed, we use it, consciously accepting this risk.
Twitterapis (operator of twitterapis.com) — data source
Role: source of public X (Twitter) posts. We send search phrases and names of monitored accounts and receive public posts, replies and profiles of their authors. It does not receive customer data.
It is not a processor — for the same reasons as Redditapis and with the same correction in relation to the version of 4 September 2026.
Contracting entity and country: outside the EEA, in accordance with the provider's terms and conditions. The direction of flow is as with Redditapis, with one exception: where a customer monitors a specific public account, its name leaves the EEA and may identify a person. The name is public, we send it only to read that account's public posts, and we do not link it with anything else; the classification of this single flow is the subject of legal consultation. The assessment of the lawfulness of the source is being prepared.
Fakturownia sp. z o.o.
Role: issuing and archiving VAT invoices — company name, tax ID, address, invoice e-mail address, amounts.
Country: Poland (EEA).
OpenAI Ireland Ltd (OpenAI)
Role: the language model that scores a post in AI mode (model gpt-5.6-luna). Names, e-mail addresses, phone numbers and profile links are removed from a post's text before it is sent.
Contracting country: Ireland (EEA), the contracting entity for EEA customers. Processing country: United States. Transfer outside the EEA: standard contractual clauses. Requests are processed on OpenAI's servers in the United States. The transfer rests on the European Commission's standard contractual clauses incorporated into OpenAI's Data Processing Addendum. Content sent through the API is not used to train models, and abuse-monitoring logs are deleted after 30 days.
Change history
7 September 2026 — Redditapis and Twitterapis moved from processors to data sources, together with a description of the direction of flow: we send a query and receive public content.
4 September 2026 — Redditapis and Twitterapis added (access to public Reddit and X content).
2 September 2026 — first version of the list.