Subprocessors
Last updated: October 10, 2026
Overview
Pointerly uses the providers below to run the service. They process personal data on our behalf, under contracts that limit their use of it to providing their service to us. Platforms you connect yourself are listed separately: they receive data because you told Pointerly to send it there, and their own terms apply. How we handle personal data overall is described in our Privacy Policy.
Subprocessors
Supabase (on Amazon Web Services)
Database, authentication, encrypted secret storage (Vault), scheduled jobs, and file storage for workspace uploads and legacy link images that have not yet been moved to Cloudflare R2.
- Data
- All account, workspace, connected account, end-user, analytics, billing, and audit data stored by Pointerly, plus files still kept in Supabase Storage.
- Location
- United States (AWS us-west-2, Oregon)
Vercel
Application hosting, serverless functions, short-link redirects, and content delivery.
- Data
- All requests to Pointerly, including IP addresses and request metadata, and application logs.
- Location
- United States, with global edge locations
Stripe
Subscriptions, invoices, tax calculation, checkout, and brand-to-creator payments.
- Data
- Billing contact, plan and usage charges, payment details (collected directly by Stripe), and creator payout and identity details.
- Location
- United States and other Stripe regions
OpenAI
Primary AI provider for Poppy, content generation, suggestions, shop assistants, and link destination safety classification; embeddings for file search. The only AI provider for sensitive data.
- Data
- Prompts, conversation context, relevant workspace data, attachment text, and shopper messages. Sensitive data (Google user data, mailbox and connected-workspace content, attached files, audience messages) is sent only to OpenAI, never to another AI provider. Google user data uses a no-training OpenAI route by default, or OpenAI's shared program if the workspace turns on "Allow AI on my Google data". See the Privacy Policy for OpenAI’s use of this data.
- Location
- United States
DeepSeek
Fallback AI provider for standard requests, used when the primary provider is unavailable or fails, including for link destination safety classification.
- Data
- Standard request data only (prompts and workspace content such as links, products, and posts). Never Google user data, mailbox or connected-workspace content, attached files, or messages from your audience.
- Location
- People's Republic of China
Composio
Brokers connections to Google Drive, Sheets, Calendar, Gmail, Meet, and Notion when you connect them for AI or workflow features.
- Data
- Connection tokens and the files, events, or messages a feature reads or writes at your request.
- Location
- United States
Resend
Transactional email for account, security, billing, and product notifications.
- Data
- Recipient address, message content, and delivery metadata.
- Location
- United States
Spacemail (Spaceship)
Mailbox and outgoing mail server for support and some account emails.
- Data
- Support conversations, recipient addresses, and message content.
- Location
- United States
Cloudflare
DNS and CDN for Pointerly hostnames; bot protection on sign-up, login, waitlist, contact, and abuse report forms (Turnstile); public object storage (R2) for optimized link and automation images served from media.pointerly.io; DNS filtering lookups that flag adult and malicious destinations; and Browser Rendering of public retailer pages when you import a storefront.
- Data
- Browser signals and IP address of form visitors; public link and automation image files (product and Open Graph images); destination domains of links; the public page addresses you import; DNS and request metadata for Pointerly hostnames.
- Location
- United States, with global edge locations
Google Web Risk
Checks link destinations for malware, phishing, social engineering, and unwanted software.
- Data
- Destination addresses of links.
- Location
- United States
abuse.ch URLhaus (when enabled)
Checks link destinations against a public list of malware distribution sites. Not currently enabled.
- Data
- Destination addresses of links.
- Location
- Switzerland
Apple Push Notification service
Delivers push notifications to the iOS app.
- Data
- Device push token and notification content.
- Location
- United States
Mapbox
Map tiles for location charts in analytics dashboards.
- Data
- IP address and request metadata of the dashboard user’s browser.
- Location
- United States
Adobe Acrobat Sign
Electronic signature of contracts you send through Pointerly.
- Data
- Contract documents and the names and email addresses of signers.
- Location
- United States
Google Analytics and Microsoft Clarity
Website analytics on our marketing pages, only after you accept analytics cookies.
- Data
- Page views, interactions, device information, and cookie identifiers.
- Location
- United States
If your workspace adds its own AI provider key, that provider acts under your agreement with it, not as Pointerly's subprocessor.
Platforms you connect
Data goes to these platforms only when you or a member of your workspace connects them and uses a feature that sends data there, such as publishing a post, replying to a message, exporting a report, or syncing a sheet. They are controlled by you and governed by their own terms:
Meta (Instagram, Facebook, WhatsApp), TikTok, Google and YouTube, Telegram, X, Threads, Amazon (Associates, Product Advertising and Creators APIs, Ads), eBay, Walmart, Shopify, Google Sheets and Drive, Gmail, Notion, Airtable, Trello, Slack, Discord, Zoom, Dropbox, Microsoft OneDrive, HubSpot, Mailchimp, and similar tools.
Restricted partner data
Amazon Ads API and Creator Connections data is restricted partner data in Pointerly. We do not sell it, do not share it with outside parties on our own initiative, and do not push it to third-party services automatically.
- Default automated exports of restricted Amazon partner data are blocked.
- Allowed exports must be started by the customer and sent only to the customer's connected destination.
- Pointerly records audit metadata for allowed restricted partner data exports.
- Official Amazon Creator Connections API sync remains disabled until Amazon approves the required app, scopes, and endpoints.
Changes and notice
We update this page when we add or replace a subprocessor or change what one does. Customers with a data processing agreement can ask to be notified of changes in advance by emailing privacy@pointerly.io.
Version history
- October 10, 2026: Expanded Cloudflare to include Turnstile on auth and report forms, R2 public storage for link and automation images (media.pointerly.io), DNS/CDN for Pointerly hostnames, and Browser Rendering. Clarified that Supabase Storage still holds workspace uploads and legacy link images until migration completes.
- October 2, 2026: Confirmed Supabase (AWS us-west-2) and Spacemail locations. Sensitive data goes only to OpenAI, never to DeepSeek. Added Google Web Risk and Cloudflare DNS filtering for link safety checks, and abuse.ch URLhaus for when it is enabled.
- October 10, 2026: Added OpenAI, DeepSeek, Composio, Spacemail, Cloudflare, Apple Push Notification service, Mapbox, Adobe Acrobat Sign, Google Analytics, and Microsoft Clarity, with locations.
- April 30, 2026: Previous version.