Sub-Processor List
Compass uses the sub-processors listed below to provide the service. Almost all of them are bound by a written agreement no less protective of personal data than our Data Processing Agreement. Where that is not the case, the table says so plainly and tells you what we are doing about it.
We notify you at least 30 days before adding a new sub-processor, by email and by in-product notification. You may object on reasonable data protection grounds during the notice period. If we cannot resolve the objection, you may cancel the affected services with a pro-rata refund.
Current Sub-Processors
| Sub-processor | Service | Location | Transfer mechanism |
|---|---|---|---|
| Anthropic, PBC | AI inference (primary, Claude API) | United States | UK IDTA and EU SCCs |
| Supabase, Inc. | Database, authentication, file storage | European Union and United Kingdom | No restricted transfer (EU/UK regions) |
| Vercel, Inc. | Hosting and edge compute | United States and European Union | UK IDTA and EU SCCs |
| Stripe Payments UK Ltd | Payment processing for Compass subscriptions | United Kingdom | No restricted transfer |
| Stripe, Inc. (Stripe Tax) | VAT, GST, and sales-tax compliance | United States | UK IDTA and EU SCCs |
| MailerSend, Inc. | Transactional email delivery (account, security, and service email) | Data hosted in the European Union (Belgium); the contracting company is in the United States | No restricted transfer for data at rest (EU hosting, UK adequacy); EU SCCs and the UK Addendum in MailerSend's Data Processing Addendum cover access from the United States |
| Resend, Inc. | Contact-form email delivery | United States | UK IDTA and EU SCCs |
| MailerLite (UAB MailerLite) | Marketing email delivery, sent only where you have opted in | European Union (Lithuania) | No restricted transfer (EU/UK adequacy) |
| Ahrefs Pte. Ltd. | Website analytics, cookieless and aggregate | Singapore | UK IDTA and EU SCCs |
| PostHog, Inc. | Website and funnel analytics, cookieless and aggregate | European Union (Frankfurt) | No restricted transfer (EU region); UK IDTA and EU SCCs for any US support access |
| BunnyWay d.o.o. (Bunny) | Video and image delivery network | European Union (Slovenia); content is delivered from edge locations worldwide | Bunny is established in the EU, so there is no restricted transfer to Bunny itself. Worldwide edge delivery is set by our own configuration, and IP addresses are anonymised by default |
| Serper | Search results for the market-research feature; receives your business name, location, and competitor names as search queries, and passes them to Google to run the search | United States and Singapore. Serper has told us that log data is held in the United States wherever the query comes from | Serper does not offer a data processing agreement or standard contractual clauses. We are replacing this provider for that reason |
| Google (reCAPTCHA) | Bot and fraud protection on the contact, subscribe, and sign-up forms | United States | UK IDTA and EU SCCs |
Marketing email runs on MailerLite and is sent only to people who have opted in; you can withdraw consent at any time. Transactional email (account verification, password resets, security notices, and other service email) runs on MailerSend. Contact-form email runs on Resend. Video and images on our pages are delivered by Bunny, which receives the technical information needed to deliver a file to you, including your IP address, and does not build a profile of you. Serper provides the search results behind the market-research feature and receives your business name, your location, and competitor names as search queries, which it passes to Google in real time to run the search. Serper does not offer a data processing agreement or standard contractual clauses, and holds its log data in the United States, so we are replacing it. Website analytics runs on Ahrefs and is cookieless, so it does not set a cookie or build a profile. Funnel analytics also run on PostHog, hosted in the European Union (Frankfurt) and configured to be cookieless: it sets no cookie and no device storage, discards your IP address, and does not build a profile. Google reCAPTCHA protects our forms; your use of it is subject to Google's own Privacy Policy and Terms, as set out in the Cookie Notice.
Processors We Plan to Add
We are building creative-media features (for example, image, voice, and video generation, and licensed audio) that are not part of the launch service. The processors below are planned for those features and are not active yet: we are not sharing any personal data with them today. Each one is added to the current sub-processors list above, with the standard 30 days' notice, only when the feature that uses it goes live.
| Planned sub-processor | Planned use |
|---|---|
| OpenAI OpCo LLC | Additional or fallback AI inference |
| Fal AI, Inc. | Image generation |
| ElevenLabs, Inc. | Voice synthesis |
| Runway AI, Inc. | Video generation |
| Epidemic Sound AB | Licensed audio |
Notice of Changes
We email you at least 30 days before any real change to this list, including the addition or removal of a sub-processor, a change of location, or a change of transfer mechanism. Correcting an entry we have found to be wrong is different: we do that as soon as we know, and record it in the change log. The current version is always at https://compassbystarlight.com/legal/sub-processors. The change log sits at the bottom.
Contact
For questions about a sub-processor, email privacy@starlighttech.ai.
Change Log
- v1.4, 13 August 2026. Corrected two statements that the v1.3 Serper correction had made inaccurate. The opening line now says that almost all sub-processors are bound by a written agreement, with any exception stated plainly in the table, and the notice-of-changes section now distinguishes 30 days' notice of a real change from correcting an entry we have found to be wrong, which we do as soon as we know. No change to any provider's row or to any processing.
- v1.3, 12 August 2026. Corrected the entry for Serper after they answered our questions: their log data is held in the United States, they do not offer a data processing agreement or standard contractual clauses, and they pass our search queries to Google to run the search. We are replacing this provider.
- v1.2, 3 August 2026. Added three providers already used by the service: MailerSend (transactional email), Bunny (video and image delivery), and Serper (market-research searches). Corrected the entry for Resend, which delivers contact-form email. These providers were already in use; this entry corrects an omission from the list rather than adding new processing.
- v1.1, 18 June 2026. Added PostHog, Inc. (website and funnel analytics, cookieless and aggregate, hosted in the European Union, Frankfurt).
- v1.0, 10 June 2026. First publication.
Starlight Tech Limited, company number 17175089, registered office 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, registered in England and Wales.