Sub-Processor List
Compass uses the sub-processors listed below to provide the service. Each is bound by a written agreement no less protective of personal data than our Data Processing Agreement.
We notify you at least 30 days before adding a new sub-processor, by email and by in-product notification. You may object on reasonable data protection grounds during the notice period. If we cannot resolve the objection, you may cancel the affected services with a pro-rata refund.
Current Sub-Processors
| Sub-processor | Service | Location | Transfer mechanism |
|---|---|---|---|
| Anthropic, PBC | AI inference (primary, Claude API) | United States | UK IDTA and EU SCCs |
| Supabase, Inc. | Database, authentication, file storage | European Union and United Kingdom | No restricted transfer (EU/UK regions) |
| Vercel, Inc. | Hosting and edge compute | United States and European Union | UK IDTA and EU SCCs |
| Stripe Payments UK Ltd | Payment processing for Compass subscriptions | United Kingdom | No restricted transfer |
| Stripe, Inc. (Stripe Tax) | VAT, GST, and sales-tax compliance | United States | UK IDTA and EU SCCs |
| Resend, Inc. | Transactional email delivery (account, security, and contact-form email) | United States | UK IDTA and EU SCCs |
| MailerLite (UAB MailerLite) | Marketing email delivery, sent only where you have opted in | European Union (Lithuania) | No restricted transfer (EU/UK adequacy) |
| Ahrefs Pte. Ltd. | Website analytics, cookieless and aggregate | Singapore | UK IDTA and EU SCCs |
| PostHog, Inc. | Website and funnel analytics, cookieless and aggregate | European Union (Frankfurt) | No restricted transfer (EU region); UK IDTA and EU SCCs for any US support access |
| Google (reCAPTCHA) | Bot and fraud protection on the contact, subscribe, and sign-up forms | United States | UK IDTA and EU SCCs |
Marketing email runs on MailerLite and is sent only to people who have opted in; you can withdraw consent at any time. Transactional email (receipts, password resets, security notices, and contact-form replies) runs on Resend. Website analytics runs on Ahrefs and is cookieless, so it does not set a cookie or build a profile. Funnel analytics also run on PostHog, hosted in the European Union (Frankfurt) and configured to be cookieless: it sets no cookie and no device storage, discards your IP address, and does not build a profile. Google reCAPTCHA protects our forms; your use of it is subject to Google's own Privacy Policy and Terms, as set out in the Cookie Notice.
Processors We Plan to Add
We are building creative-media features (for example, image, voice, and video generation, and licensed audio) that are not part of the launch service. The processors below are planned for those features and are not active yet: we are not sharing any personal data with them today. Each one is added to the current sub-processors list above, with the standard 30 days' notice, only when the feature that uses it goes live.
| Planned sub-processor | Planned use |
|---|---|
| OpenAI OpCo LLC | Additional or fallback AI inference |
| Fal AI, Inc. | Image generation |
| ElevenLabs, Inc. | Voice synthesis |
| Runway AI, Inc. | Video generation |
| Epidemic Sound AB | Licensed audio |
Notice of Changes
We email you at least 30 days before any change to this list, including the addition or removal of a sub-processor, a change of location, or a change of transfer mechanism. The current version is always at https://compassbystarlight.com/legal/sub-processors. The change log sits at the bottom.
Contact
For questions about a sub-processor, email privacy@starlighttech.ai.
Change Log
- v1.1, 18 June 2026. Added PostHog, Inc. (website and funnel analytics, cookieless and aggregate, hosted in the European Union, Frankfurt).
- v1.0, 10 June 2026. First publication.
Starlight Tech Limited, company number 17175089, registered office 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, registered in England and Wales.