Legal
Sub-processors
Last updated: October 15, 2026
UpRadar.ai is operated by MAYA Tech Services LLC (Delaware, USA). To run the Service we use the third-party providers listed below. Each processes personal data only to provide its service to us.
This page is part of our Privacy Policy and our Data Processing Addendum.
Infrastructure and service providers
| Vendor | Purpose | Personal data | Transfer mechanism |
|---|---|---|---|
| Vercel Inc. | Hosting of the app (app.upradar.ai) and website (upradar.ai) | IP address, request data | EU SCCs, UK Addendum (Vercel DPA) |
| Railway Corp. | API and background workers | All Service data while it is processed; logs | EU SCCs / DPF (Railway DPA) |
| Neon (Databricks, Inc.) | Primary database | Account, brand setup, audits, AI answers, billing references, IP addresses in audit records | EU SCCs (Neon DPA) |
| Upstash, Inc. (Redis) | Job queue and rate limiting | Audit job data, including IP address, link source and domain (short-lived) | EU SCCs (Upstash DPA) |
| Supabase, Inc. | Sign-in and authentication | Email address, hashed password, sign-in data | EU SCCs, UK and Swiss addenda (Supabase DPA) |
| Stripe, LLC | Payments and subscription billing | Email, billing details, card data (held by Stripe, never by us) | DPF, EU SCCs (Stripe DPA) |
| Resend (Plus Five Five, Inc.) | Sending service, digest and free-report emails; sign-in emails | Email address, email content | EU SCCs, UK Addendum (Resend DPA) |
| Cloudflare, Inc. | Bot protection on the free audit (Turnstile), DNS, inbound email routing | IP address, browser signals; emails sent to us | DPF, EU SCCs (Cloudflare DPA) |
| Functional Software, Inc. (Sentry) | Error monitoring | Technical error data; personal data removed where configured | DPF, EU SCCs (Sentry DPA) |
| PostHog, Inc. (EU Cloud) | Product analytics | Account ID or anonymous audit ID, usage events | Processed in the EU (PostHog DPA) |
| Google LLC (Google Fonts) | Web fonts in the app (until we host them ourselves) | IP address, browser data | — |
| UptimeRobot | Uptime monitoring of our endpoints | None | — |
AI engine providers
We send these providers questions that mention your brand, domain, category and tracked competitors, and your custom prompts. We never send your email address, account ID or payment details. Details are in section 4 of our Privacy Policy.
| Vendor | Purpose | Personal data | Transfer mechanism |
|---|---|---|---|
| OpenAI, L.L.C. | ChatGPT engine; analysis of answers; setup suggestions | Brand details, prompts, AI answers (may mention people) | EU SCCs (OpenAI DPA) |
| Anthropic, PBC | Claude engine | Brand details, prompts | DPA incorporated into Commercial Terms |
| Google LLC | Gemini engine (paid API) | Brand details, prompts | Google DPA for processor services |
| Perplexity AI, Inc. | Perplexity engine | Brand details, prompts | — |
### Customer-directed engines
These engines are queried only if you turn them on in your engine settings. Turning one on is your instruction to us to send it data.
| Vendor | Purpose | Personal data | Transfer mechanism |
|---|---|---|---|
| Mistral models, via OpenRouter, Inc. (US) and its hosting providers (Mistral AI SAS or a third-party host such as DeepInfra, Parasail or Venice) | Mistral engine; OpenRouter routes each request to one of the model's hosts | Brand details, prompts | Host may be in the US or the EU; OpenRouter: United States, routing only, training on request data disabled |
| X.AI LLC | Grok engine | Brand details, prompts | — |
| DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd.) | DeepSeek engine | Brand details and the prompts you track (the same as your other engines) — never your email or payment details | None — China has no adequacy decision; DeepSeek offers no DPA |
About DeepSeek. DeepSeek stores data in the People's Republic of China and may use inputs to train its models. It does not offer a data-processing agreement. That is why it is off by default, we query it only if you turn it on, and we show you a notice before you do. When it is on, it receives the same questions as your other engines, including your custom prompts.
Changes to this list
We give at least 30 days' notice before a new sub-processor starts processing customer personal data.
- How to get notified. Email hello@upradar.ai with the subject "Subscribe to sub-processor updates". We will email you before each change and update the "Last updated" date on this page.
- Right to object. If you are a customer under our Data Processing Addendum, you can object to a new sub-processor on reasonable data-protection grounds within the notice period. If we can't reasonably accommodate your objection, you can end the affected service as described in the DPA.
Questions about this list: hello@upradar.ai.