Subprocessors
Last updated: October 7, 2026
About this list
These are the third-party providers we use to run Affiliate Manager that may process personal data. For customers, they are subprocessors under our Data Processing Addendum. How we use personal data is explained in our Privacy Policy. Some of them (the website analytics tools, for example) only handle data about visitors to our own site and our own customers, for which we are the controller; we list them here too so there is one complete list.
The platforms you connect yourself (for example Stripe, Shopify, Gumroad or PayPal accounts you link to sync sales) are not on this list: you choose them and we access them on your instructions.
Current subprocessors
| Provider | Purpose | Personal data | Location |
|---|---|---|---|
| Vercel | Application hosting, content delivery, page-performance measurement (Speed Insights) | All data the service handles passes through it in transit; request logs including IP address | United States |
| Supabase | Our database (every account, affiliate, link, click, sale, payout and prospect record) and private file storage for W-9 / W-8 tax forms | All stored service data, including tax forms that may contain a Social Security number or EIN | United States (AWS us-west-1) |
| Stripe | Web subscription billing; affiliate payout accounts through Stripe Connect | Name, email, billing details and payment method (held by Stripe, not by us); affiliate email for payout onboarding | United States |
| Apple | App Store in-app purchase billing; Sign in with Apple; push notification deliveryiOS app users | Purchase records (Apple holds payment details); Apple ID email or relay address; device push token and notification content | United States |
| RevenueCat | App Store subscription status and purchase historyiOS app users | Account id, subscription status, purchase and renewal events | United States |
| Expo (650 Industries) | Push notification relay for the iOS appiOS users who enable notifications | Device push token; notification text (for example a sale amount and an affiliate name) | United States |
| Resend | Sending transactional, account and recruiting email; receiving replies to recruiting email | Recipient name and email, message content, delivery and reply events | United States |
| Anthropic | AI Affiliate Recruiter: enriching prospect profiles and drafting recruiting emailsCustomers who use the AI Affiliate Recruiter | Prospect name, email, public profile URL and notes; the customer’s product description | United States |
| Perplexity | AI web search for affiliate discoveryCustomers on plans with AI discovery | The customer’s niche and product description; returns public information about creators | United States |
| Upstash | Rate limiting and short-lived caching | IP address or account id used as a rate-limit key, held for minutes | United States |
| Sentry | Error and crash diagnostics; masked session replay | Error reports with technical context (email addresses are scrubbed); replays only with consent | United States |
| PostHog | Product analytics in the web and iOS apps; server-side account milestonesWeb: only with consent. iOS: can be turned off in Settings (EU, UK and Switzerland: asked first) | Account id, pages and screens viewed, feature events; session recordings with all text, inputs and images masked. No name or email | United States |
| Mixpanel | Website product analytics until 2026-10-11 (no longer used; holds data collected before then until it is deleted)Only with consent | Pages viewed, clicks, device and browser data, a random visitor id | United States |
| Website analytics (Google Analytics); Sign in with GoogleAnalytics only with consent; sign-in only if you choose it | Pages viewed, device and browser data, a cookie id; for sign-in, your Google account email and name | United States | |
| DataFast | Website analytics and conversion goals; AI crawler visitsVisitor analytics only with consent; AI crawler requests are not visitors and carry no cookie | Pages viewed, referrer, a random visitor id, signup and conversion events, your account id while signed in; for AI crawler requests, the page path and the crawler’s user agent and IP | Not yet confirmed by the provider |
| GitHub | Sign in with GitHubOnly if you choose it | GitHub account email and name | United States |
| Whop | Sign in with Whop; syncing commerce data from a connected Whop accountOnly if you connect Whop | Whop account email and name; orders and members from the connected account | United States |
Transfers to providers in the United States rely on the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) where the provider is certified, and otherwise on the European Commission’s Standard Contractual Clauses with the UK Addendum.
Changes and objections
We add a new subprocessor to this page at least 30 days before it starts processing customer personal data, and update the date above. To be told by email when this list changes, write to privacy@affiliatemanager.us with the subject “Subprocessor updates”. A customer may object to a new subprocessor on reasonable data-protection grounds by writing to the same address within those 30 days. If we cannot reasonably address the objection, the customer may terminate the affected service and we will refund any prepaid fees for the period after termination.