Last updated October 21, 2026
Subprocessors
WebValet does not build everything itself. These providers process data on our behalf. We tell account owners by email at least 14 days before adding one.
Effective October 21, 2026Questions: privacy@webvalet.app
| Provider | What it does for WebValet | Data involved | Location |
|---|---|---|---|
| Cloudflare, Inc. | Hosting (Workers), D1 database, sign-in sessions, CDN, KV cache, R2 storage, Turnstile, DNS, email routing | All request data, account data, site data, encrypted tokens, entitlements, audit cache, screenshots, PDFs | D1 database in Western Europe; global edge; US company |
| Google LLC | Sign-in, Search Console and Analytics APIs, PageSpeed Insights | Name, email, read-only search and traffic data for properties you connect, audited URLs | US and global |
| Anthropic, PBC | AI models (Claude) for audit summaries, rewrites, briefs, Ask WebValet, persona reviews | Page content and your site's metrics sent in prompts; no training on your data | US |
| Polar Software Inc. | Merchant of record: checkout, subscriptions, invoices, tax | Email, plan, billing details (card data stays with Polar) | US |
| Resend, Inc. | Transactional email (Monday report, alerts, sequences) | Email address, report content | US |
| DataForSEO | Rankings, SERP, backlinks and AI mention data | Tracked keywords, your domain and competitor domains | EU and US |
| Brandfetch | Brand logos, colours and company info for audited domains | Audited domain names | EU |
| PostHog, Inc. | Product analytics | Usage events tied to a random ID or your account ID | EU cloud |
flagcdn.com (country flags) and Google's favicon service receive only the public domain or country code being displayed and no data about you. The websites you audit receive ordinary HTTP requests from our crawler.
03
Changes
Email privacy@webvalet.app to subscribe to subprocessor change notices. Business customers may object as described in the DPA.