Sub-Processor List
Compass uses the sub-processors listed below to provide the service. Almost all of them are bound by a written agreement no less protective of personal data than our Data Processing Agreement. Where that is not the case, the table says so plainly and tells you what we are doing about it.
We notify you by email at least 30 days before adding a new sub-processor. You may object on reasonable data protection grounds during the notice period. If we cannot resolve the objection, you may cancel the affected services with a pro-rata refund.
Current Sub-Processors
| Sub-processor | Service | Location | Transfer mechanism |
|---|---|---|---|
| Anthropic, PBC | AI inference (primary, Claude API) | United States | UK IDTA and EU SCCs |
| Supabase, Inc. | Database, authentication, file storage | European Union and United Kingdom | No restricted transfer (EU/UK regions) |
| Vercel, Inc. | Hosting and edge compute | United States and European Union | UK IDTA and EU SCCs |
| Stripe Payments UK Ltd | Payment processing for Compass subscriptions | United Kingdom | No restricted transfer |
| Stripe, Inc. (Stripe Tax) | VAT, GST, and sales-tax compliance | United States | UK IDTA and EU SCCs |
| MailerSend, Inc. | Email delivery: account, security and service email, and marketing email to people who have opted in | Data hosted in the European Union (Belgium); the contracting company is in the United States | No restricted transfer for data at rest (EU hosting, UK adequacy); EU SCCs and the UK Addendum in MailerSend's Data Processing Addendum cover access from the United States |
| Resend, Inc. | Contact-form email delivery | United States | UK IDTA and EU SCCs |
| MailerLite (UAB MailerLite) | The list of people who have opted in to marketing email, and of blog subscribers | European Union (Lithuania) | No restricted transfer (EU/UK adequacy) |
| Ahrefs Pte. Ltd. | Website analytics, cookieless and aggregate | Singapore | UK IDTA and EU SCCs |
| PostHog, Inc. | Website and funnel analytics, cookieless and aggregate | European Union (Frankfurt) | No restricted transfer (EU region); UK IDTA and EU SCCs for any US support access |
| BunnyWay d.o.o. (Bunny) | Video and image delivery network | European Union (Slovenia); content is delivered from edge locations worldwide | Bunny is established in the EU, so there is no restricted transfer to Bunny itself. Worldwide edge delivery is set by our own configuration, and IP addresses are anonymised by default |
| Serper | Search results for the market-research feature; receives your business name, location, and competitor names as search queries, and passes them to Google to run the search | United States and Singapore. Serper has told us that log data is held in the United States wherever the query comes from | Serper does not offer a data processing agreement or standard contractual clauses. We are replacing this provider for that reason |
| VostokInc SAS (ScrapingBee) | Fetching the public pages of your website during setup research | European Union (France) | No restricted transfer to ScrapingBee itself; its US sub-processors are covered by EU SCCs with the UK Addendum in its data processing agreement |
| Bright Data Ltd. | Fetching the public social profiles you give us during setup research | Israel | No restricted transfer (UK adequacy regulations cover Israel). We are confirming the written agreement with Bright Data |
| Google (reCAPTCHA) | Bot and fraud protection on the contact, subscribe, and sign-up forms | United States | UK IDTA and EU SCCs |
Marketing email is sent by MailerSend, only to people who have opted in, and MailerLite keeps the list of who has; you can withdraw consent at any time. Account and service email (verification, password resets, security notices, and emails about your plan) is also sent by MailerSend. Contact-form email runs on Resend. Video and images on our pages are delivered by Bunny, which receives the technical information needed to deliver a file to you, including your IP address, and does not build a profile of you. Serper provides the search results behind the market-research feature and receives your business name, your location, and competitor names as search queries, which it passes to Google in real time to run the search. Serper does not offer a data processing agreement or standard contractual clauses, and holds its log data in the United States, so we are replacing it. Website analytics runs on Ahrefs and is cookieless, so it does not set a cookie or build a profile. Funnel analytics also run on PostHog, hosted in the European Union (Frankfurt) and configured to be cookieless: it sets no cookie and no device storage, discards your IP address, and does not build a profile. Google reCAPTCHA protects our forms; your use of it is subject to Google's own Privacy Policy and Terms, as set out in the Cookie Notice.
Processors We Plan to Add
We are building creative-media features (for example, image, voice, and video generation, and licensed audio) that are not part of the launch service. The processors below are planned for those features and are not active yet: we are not sharing any personal data with them today. Each one is added to the current sub-processors list above, with the standard 30 days' notice, only when the feature that uses it goes live.
| Planned sub-processor | Planned use |
|---|---|
| OpenAI OpCo LLC | Additional or fallback AI inference |
| Fal AI, Inc. | Image generation |
| ElevenLabs, Inc. | Voice synthesis |
| Runway AI, Inc. | Video generation |
| Epidemic Sound AB | Licensed audio |
Notice of Changes
We email you at least 30 days before any real change to this list, including the addition or removal of a sub-processor, a change of location, or a change of transfer mechanism. Correcting an entry we have found to be wrong is different: we do that as soon as we know, and record it in the change log. The current version is always at https://compassbystarlight.com/legal/sub-processors.
Contact
For questions about a sub-processor, email privacy@starlighttech.ai.
Change Log
- v1.6, 25 September 2026. Corrected two entries and added two providers already in use. MailerSend sends marketing email as well as account and service email; MailerLite keeps the list of people who have opted in and sends nothing itself. ScrapingBee and Bright Data fetch the public pages of your website and the social profiles you give us during setup; they were in use before this list named them, and this entry corrects that omission rather than adding new processing.
- v1.5, 23 September 2026. Removed a promise to tell you about new sub-processors "by in-product notification". Compass has no in-product notification system, so that part of the promise could not be kept. We tell you by email, as the notice section of this page already said.
- v1.4, 13 August 2026. Corrected two statements that the v1.3 Serper correction had made inaccurate. The opening line now says that almost all sub-processors are bound by a written agreement, with any exception stated plainly in the table, and the notice-of-changes section now distinguishes 30 days' notice of a real change from correcting an entry we have found to be wrong, which we do as soon as we know. No change to any provider's row or to any processing.
- v1.3, 12 August 2026. Corrected the entry for Serper after they answered our questions: their log data is held in the United States, they do not offer a data processing agreement or standard contractual clauses, and they pass our search queries to Google to run the search. We are replacing this provider.
- v1.2, 3 August 2026. Added three providers already used by the service: MailerSend (transactional email), Bunny (video and image delivery), and Serper (market-research searches). Corrected the entry for Resend, which delivers contact-form email. These providers were already in use; this entry corrects an omission from the list rather than adding new processing.
- v1.1, 18 June 2026. Added PostHog, Inc. (website and funnel analytics, cookieless and aggregate, hosted in the European Union, Frankfurt).
- v1.0, 10 June 2026. First publication.
Starlight Tech Limited, company number 17175089, registered office 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, registered in England and Wales.