HyperFound — Sub-processors
Last updated: 25 June 2026.
HyperFound is operated by Tom Marx, autónomo (NIE Y7134879V), trading as "HyperFound", established in Spain. We act as data controller for account, billing, usage, and marketing data, and as processor for customer-site visitor data and other Customer Content. We engage the sub-processors below to deliver the Service, and we notify customers at least 30 days before a new sub-processor begins processing Customer Personal Data; customers may object as set out in the DPA. Questions: tom@hyperfound.ai.
A. Infrastructure (process all data categories, in transit/at rest)
| Sub-processor | Entity / country | Purpose | Processing location | Transfer mechanism |
|---|---|---|---|---|
| Supabase | Supabase Inc. (US) | Database, authentication, storage | AWS (EU region) | SCCs (2021/914 Mod 2) |
| Vercel | Vercel Inc. (US) | Application + API hosting, cron | AWS / Azure / GCP | SCCs (Mod 2 + 3), UK IDTA, Swiss |
| Upstash | Upstash, Inc. (US) | Workflow queue, rate-limit state | AWS | SCCs + EU-US DPF |
B. Payments
| Sub-processor | Entity / country | Purpose | Processing location | Transfer mechanism |
|---|---|---|---|---|
| Stripe | Stripe Payments Europe Ltd (Ireland) / Stripe, Inc. (US) | Subscription billing & payments | EU + US | SCCs + EU-US DPF |
C. Communications
| Sub-processor | Entity / country | Purpose | Processing location | Transfer mechanism |
|---|---|---|---|---|
| Resend (Plus Five Five, Inc.) | US | Transactional, welcome & product email | US | SCCs + EU-US DPF |
D. Product analytics (our website only)
| Sub-processor | Entity / country | Purpose | Processing location | Transfer mechanism |
|---|---|---|---|---|
| Google Analytics 4 | Google Ireland Ltd / Google LLC | Marketing-site analytics (consent-gated) | Global | SCCs (P2P) / EU-US DPF |
E. AI inference — providers that process Customer Content
These receive captured AI-engine answers and related text (which may contain incidental personal data) to produce measurements. Each is contractually bound not to train its models on Customer Content.
| Provider | Entity / country | Purpose | Transfer mechanism |
|---|---|---|---|
| OpenAI | OpenAI, L.L.C. (US) | Entity / intent / brand extraction | DPA + SCCs/DPF — no training on Customer Content |
| Anthropic | Anthropic Ireland Ltd (IE / US) | Entity extraction & classification | DPA — no training on Customer Content |
| xAI | X.AI LLC (US) | Entity extraction & brand analysis | DPA — no training on Customer Content |
F. Competitive-intelligence capture (public web + AI-engine outputs)
| Sub-processor | Entity / country | Purpose | Transfer mechanism |
|---|---|---|---|
| Bright Data Ltd | Israel (+ global egress) | Capture of public consumer AI-engine answers | Israel (EU adequacy) / SCCs |
| DataForSEO OÜ | Estonia (EU) | Google SERP / AI Overview & keyword data | EU entity; SCCs/adequacy for onward US sub-processing |
Measured AI engines (not sub-processors of your personal data)
We query the AI engines below with synthetic, platform-generated prompts (e.g., "best [industry] tools", "[brand] vs [competitor]") to measure brand visibility. These prompts contain brand/competitor/industry terms — not your personal data and not your end-users' queries. We capture their public outputs (directly or via the capture providers in §F): ChatGPT (OpenAI), Microsoft Copilot, Google (Gemini / AI Overviews), Perplexity, Grok (xAI), and DeepSeek.
DeepSeek is operated from the People's Republic of China; we send it only synthetic, non-personal queries to measure it, and never route Customer Personal Data to it.
Customer-connected integrations (your own accounts — not our sub-processors)
Google Search Console, Google Analytics 4, Slack — you connect these via OAuth; data flows under your agreement with the provider; you control scope and may disconnect at any time. Outbound webhooks deliver to your own endpoint.