How to read this list#
A subprocessor is a company that processes data on our behalf to provide part of the service. Each entry names the provider, what it does for Glowwer, and the categories of data it can receive — described in the same terms the Privacy Policy uses. Each provider handles what it receives under its own terms and retention, which may differ from ours.
We list a provider as in use when the product calls it on the normal customer path, and note when a call only happens under a specific condition. Providers whose code exists but is not called by any customer path are listed separately as not in use, so that this page is accurate in both directions. We do not list where each provider’s servers are; ask us if you need that for a data-protection assessment.
In use#
Vercel
Application hosting, edge network and serverless functions
Serves glowwer.com and runs the application; request logs and build logs live here.
- Data it can receive
- Account identity (name, email, sign-in identifiers); Your business URL and the public web content we read about it; Photos, logos and files you upload; Generated drafts, captions, images and your edits; Connected social account identifiers and publishing status; Subscription and payment status (never full card numbers); WhatsApp phone numbers and message content, when you enable messaging; Product usage events and pseudonymous identifiers; IP address, browser and device details, request logs, error reports.
Supabase
Database and file storage
Stores accounts, brands, posts, plans, uploaded and generated media (the brand-assets bucket), channel records and messaging rows.
- Data it can receive
- Account identity (name, email, sign-in identifiers); Your business URL and the public web content we read about it; Photos, logos and files you upload; Generated drafts, captions, images and your edits; Connected social account identifiers and publishing status; Subscription and payment status (never full card numbers); WhatsApp phone numbers and message content, when you enable messaging.
Clerk
Authentication and account management
Sign-up, sign-in, sessions and the account record. Clerk sends the transactional emails that sign-in requires (verification codes, magic links).
- Data it can receive
- Account identity (name, email, sign-in identifiers); IP address, browser and device details, request logs, error reports.
Anthropic
AI models (Claude) and their web search / web fetch tools
Reads your website content and public information about your business, writes captions and plans, drives the Creative Director conversation, and checks generated work.
- Data it can receive
- Your business URL and the public web content we read about it; Photos, logos and files you upload; Generated drafts, captions, images and your edits; WhatsApp phone numbers and message content, when you enable messaging.
fal.ai
Hosted image, audio and video generation models
Generates and edits post images from prompts and your brand references (the image models are served by fal; some are third-party models such as Google's image models routed through fal).
- Data it can receive
- Photos, logos and files you upload; Generated drafts, captions, images and your edits; Your business URL and the public web content we read about it.
Firecrawl
Website crawling and page screenshots
Reads and screenshots the website whose address you paste, so Glowwer can learn your brand.
- Data it can receive
- Your business URL and the public web content we read about it.
Inngest
Background job orchestration
Runs extraction, weekly generation, publishing, WhatsApp turns and the daily clean-up jobs as durable background functions; event payloads carry record identifiers and job state.
- Data it can receive
- Your business URL and the public web content we read about it; Generated drafts, captions, images and your edits; Connected social account identifiers and publishing status; WhatsApp phone numbers and message content, when you enable messaging.
Zernio
Social publishing and WhatsApp messaging aggregator
Holds the OAuth connection to your social accounts and publishes approved posts to them; when you enable WhatsApp, relays messages between your phone and Glowwer. Glowwer stores only the account and profile identifiers Zernio returns, never your social passwords or tokens.
- Data it can receive
- Connected social account identifiers and publishing status; Generated drafts, captions, images and your edits; WhatsApp phone numbers and message content, when you enable messaging.
PostHog
Product analytics
Page views and product funnel events (brand started, week generated, post approved…) under pseudonymous identifiers, so we can see where the product works and where it does not. No session recording.
- Data it can receive
- Product usage events and pseudonymous identifiers; IP address, browser and device details, request logs, error reports.
- When it runs
- When analytics is configured for the deployment. How it loads in your browser, and your choices, are in the Cookie Policy.
Sentry
Error and performance monitoring
Receives error reports and a sample of performance traces so we can fix failures; reports carry stack traces and request metadata. Session replay is not enabled.
- Data it can receive
- IP address, browser and device details, request logs, error reports.
- When it runs
- When error monitoring is configured for the deployment.
Public lookup services (Apple App Store search, Google favicon service, Clearbit logo, DuckDuckGo icons)
Unauthenticated public endpoints
Resolve an app listing by name and fetch public logos / favicons for the brand and its competitors. Only a business or app name / domain is sent; no customer identity.
- Data it can receive
- Your business URL and the public web content we read about it.
Google Fonts
Web font delivery
Loads the fonts your brand uses on the website-reading screen, the add-a-brand reading screen and the font editor on Your brand so the page can show them in your own typeface; the request carries your IP address and browser details, as any web request does.
- Data it can receive
- IP address, browser and device details, request logs, error reports.
In use only under a condition#
These run only when the named configuration or situation is present. Absent it, the product does not call them.
Stripe
Payments and subscription billing
Processes card payments and manages subscriptions when paid plans are turned on; Glowwer stores the subscription status and identifiers, never card numbers.
- Data it can receive
- Account identity (name, email, sign-in identifiers); Subscription and payment status (never full card numbers).
- When it runs
- Only once paid plans are switched on. Today billing is off: no payment call is made and nobody is charged.
Upstash (Redis)
Rate-limit counters
Counts requests per IP address for a short window so one visitor cannot exhaust the free brand extraction for everyone.
- Data it can receive
- IP address, browser and device details, request logs, error reports.
- When it runs
- When a rate-limit store is configured for the deployment; without one, rate limiting is off.
Browserless
Hosted headless browser (page rendering)
Rasterises designed post graphics to images on Vercel, where no local browser exists.
- Data it can receive
- Generated drafts, captions, images and your edits; Your business URL and the public web content we read about it.
- When it runs
- When a designed post graphic is turned into an image on our servers, and the rendering service is configured.
Google (Places API)
Business listing lookup
Looks up your business listing (category, locations, public rating summary) during extraction so the brief reflects a real local business.
- Data it can receive
- Your business URL and the public web content we read about it.
- When it runs
- When a listing-lookup key is configured; otherwise the extraction uses web search instead.
ZapCap
Video caption rendering
Adds captions to generated video posts.
- Data it can receive
- Generated drafts, captions, images and your edits.
- When it runs
- Only for a video post. The standard week is five image posts, and no customer week plans a video post today.
Resend
Transactional email delivery
Sends the yearly renewal reminder for a paid monthly plan (your account email, plan, amount and a cancel link) — the one service email the product can send. No marketing email is sent, and the code refuses any message without an unsubscribe route and a postal address.
- Data it can receive
- Account identity (name, email, sign-in identifiers); Subscription and payment status (never full card numbers).
- When it runs
- Only while paid billing is switched on, the reminder job is enabled and a sender identity is configured. Billing is off today, so nothing has been sent; nothing sends with billing off.
Not in use#
Code for these exists in the product, but no customer path calls them today. They are listed so nobody has to guess.
Changes to this list#
When we add a provider that will receive customer data, we update this page and the date at the top before it goes live, and we tell account holders by email or in the product where a change materially affects how their data is processed. Questions: privacy@glowwer.com.