policy
Sub-processors
Last updated 7 August 2026
Third parties that process data on our behalf. The list is short because the product is early, and it is published because a data processing agreement without one is unreviewable. Adding to it requires notice to customers, not a quiet edit.
Current sub-processors
| Processor | Purpose | What it receives | Location |
|---|---|---|---|
| OpenAI | The funnel assistant | Computed funnel totals only: step names, counts, rates and costs. No event rows, no visitor identifiers, no IP addresses. Plus a salted hash of the signed-in customer for abuse tracing. | United States |
| Splitforms | Beta signup form delivery | What you type into the beta form: name, email, optionally a website, and your message. Nothing from any tracking script. | See their documentation |
| Cloudflare | Application hosting, CDN and edge security | Requests to this site, as any host does. Also the raw event archive, which is stored in Cloudflare R2. | Global edge network |
| Oracle Cloud Infrastructure | Database and authentication hosting | All stored product data, including collected events. | Phoenix, Arizona, United States |
What the assistant does not receive
Worth stating separately, because it is the question a customer should ask about any product with an AI feature. The assistant is given the numbers the funnel engine has already computed, and nothing else. It never receives raw events, visitor identifiers, IP addresses, URLs, or anything a form field contained.
It also cannot state a figure the engine did not produce: its output is checked against those numbers and discarded if it introduces one. That is a property of the code rather than a promise about the model, and the reasoning is on the features page.
Honest gaps
The database runs on our own infrastructure in the United States, in a single region, and there is no EU option today. If you are in the EU or UK, that is the thing to weigh when evaluating us. A move to an EU provider is planned, and it has not happened yet.
Because we self-host the database software rather than buying it as a service, Supabase is not a sub-processor and is absent from the table above. Oracle, who provide the machine it runs on, is.
We have no SOC 2 report or ISO 27001 certificate, and neither do we claim our sub-processors' certifications as our own. See security for what is and is not in place.
Notice of changes
Adding a sub-processor means updating this page and telling customers, with the date at the top changed. Removing one is recorded the same way. We do not treat this as a page that quietly drifts.
Questions about any of this go to privacy@paidamplification.com. Our other policies: Privacy, Terms, Cookies, Security, Sub-processors.