Sub-Processor List
Compass uses the sub-processors listed below to provide the service. Each is bound by a written agreement no less protective of personal data than our Data Processing Agreement.
We notify you at least 30 days before adding a new sub-processor, by email and by in-product notification. You may object on reasonable data protection grounds during the notice period. If we cannot resolve the objection, you may cancel the affected services with a pro-rata refund.
Current Sub-Processors
| Sub-processor | Service | Location | Transfer mechanism |
|---|---|---|---|
| Anthropic, PBC | AI inference (primary, Claude API) | United States | UK IDTA and EU SCCs |
| Supabase, Inc. | Database, authentication, file storage | European Union and United Kingdom | No restricted transfer (EU/UK regions) |
| Vercel, Inc. | Hosting and edge compute | United States and European Union | UK IDTA and EU SCCs |
| Stripe Payments UK Ltd | Payment processing for Compass subscriptions | United Kingdom | No restricted transfer |
| Stripe, Inc. (Stripe Tax) | VAT, GST, and sales-tax compliance | United States | UK IDTA and EU SCCs |
| Resend, Inc. | Transactional email delivery (account, security, and contact-form email) | United States | UK IDTA and EU SCCs |
| MailerLite (UAB MailerLite) | Marketing email delivery, sent only where you have opted in | European Union (Lithuania) | No restricted transfer (EU/UK adequacy) |
| Ahrefs Pte. Ltd. | Website analytics, cookieless and aggregate | Singapore | UK IDTA and EU SCCs |
| Google (reCAPTCHA) | Bot and fraud protection on the contact, subscribe, and sign-up forms | United States | UK IDTA and EU SCCs |
Marketing email runs on MailerLite and is sent only to people who have opted in; you can withdraw consent at any time. Transactional email (receipts, password resets, security notices, and contact-form replies) runs on Resend. Website analytics runs on Ahrefs and is cookieless, so it does not set a cookie or build a profile. Google reCAPTCHA protects our forms; your use of it is subject to Google's own Privacy Policy and Terms, as set out in the Cookie Notice.
Processors We Plan to Add
We are building creative-media features (for example, image, voice, and video generation, and licensed audio) that are not part of the launch service. The processors below are planned for those features and are not active yet: we are not sharing any personal data with them today. Each one is added to the current sub-processors list above, with the standard 30 days' notice, only when the feature that uses it goes live.
| Planned sub-processor | Planned use |
|---|---|
| OpenAI OpCo LLC | Additional or fallback AI inference |
| Fal AI, Inc. | Image generation |
| ElevenLabs, Inc. | Voice synthesis |
| Runway AI, Inc. | Video generation |
| Epidemic Sound AB | Licensed audio |
Connector Providers
When you authorise a connector in your Compass account, the provider of that connector also acts as a sub-processor for the data you direct Compass to access. The current connector list, and the data fields each one accesses, is in Schedule 1 of our Data Processing Agreement.
Notice of Changes
We email you at least 30 days before any change to this list, including the addition or removal of a sub-processor, a change of location, or a change of transfer mechanism. The current version is always at https://compassbystarlight.com/legal/sub-processors. The change log sits at the bottom.
Contact
For questions about a sub-processor, email privacy@starlighttech.ai.
Change Log
- v1.0, 10 June 2026. First publication.
Starlight Tech Limited, company number 17175089, registered office 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, registered in England and Wales.