Last updated: August 23, 2026
These are the third-party services we rely on to deliver Polinary. Each acts on our instructions under contract, and each is bound to confidentiality and security obligations. Where a provider is outside the UK or EEA, transfers are made under the safeguards permitted by Chapter V of the GDPR.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Supabase | Database, authentication, scheduled jobs | All application data | Project region |
| Vercel | Application hosting | Request metadata, application logs | United States / edge |
| Stripe | Subscription billing | Customer email, billing details. Card data is held by Stripe and never reaches us | United States / Ireland |
| Anthropic | Script generation and personalization | Prompt content. Under BYOK this runs on your own key and Anthropic is your processor, not ours | United States |
| Verifalia | Email deliverability verification | Email addresses submitted for verification | European Union (Italy) |
| Resend | Transactional and outreach email delivery | Recipient address, message content | United States |
| Gmail inbox connection (per-user OAuth) | Access and refresh tokens, encrypted at rest; message metadata for reply detection | United States | |
| Microsoft | Outlook inbox connection (per-user OAuth) | Access and refresh tokens, encrypted at rest | United States |
| Cloudflare | Bot mitigation (Turnstile) | Challenge token only | Global |
If you connect your own AI or enrichment provider key, that provider processes data under your agreement with them, using your credential. In that arrangement they are your sub-processor rather than ours, and we neither resell nor pool the data they return.
We update this page when we add or remove a sub-processor. If you have a data processing agreement with us that entitles you to advance notice of changes, we will give that notice as agreed. To request a copy of our DPA, or to raise an objection to a new sub-processor, email privacy@polinary.com.