Legal
Sub-processors
Last updated October 2026
VibeToApp uses the service providers below to run the platform. Those marked processor act only on our instructions under written data processing terms. We give customers at least 30 days’ notice (in the app or by email) before adding or replacing a sub-processor that handles customer data, so they can object as described in our Data Processing Agreement.
Sub-processors
| Provider | Purpose | Personal data | Location | Transfer safeguard | Status |
|---|---|---|---|---|---|
| [HOSTING PROVIDER] | Servers that run the platform and host published sites; stores the database and image cache | All platform data (accounts, sites, leads, logs) | [HOSTING LOCATION] | [None if hosted in the EU/EEA — otherwise SCCs] | In use |
| OrcaRouter (AI model gateway) Routes requests to upstream model providers chosen in Admin → AI; [list upstream providers and confirm no training on customer data]. | Generating and editing site content; halal content classification | Prompts, business descriptions, research summaries, site text, chat edit requests (no passwords, no leads) | [COUNTRY — verify] | [SCCs / EU-US Data Privacy Framework — verify] | In use |
| Exa Labs, Inc. (exa.ai) | Searching public information about the business the customer asked us to build a site for | Business name or website address entered by the customer | USA | [SCCs / DPF — verify] | In use |
| Google Cloud — Places API (Google LLC / Google Ireland Ltd) | Looking up the public Google Business profile of the customer’s business | Business name or website address entered by the customer | USA / global | EU-US Data Privacy Framework; Google Cloud Data Processing Addendum (SCCs) | Not in use (optional) |
| Openprovider (Hosting Concepts B.V.) Registrars and registries are separate controllers for WHOIS data under ICANN rules [verify with the lawyer]. | Registering and renewing domains customers get through the platform (the customer is the registrant) | Domain name; registrant contact details (name, organisation, email, phone, postal address), passed on to the registry | Netherlands (EU); registries worldwide | EU; registries outside the EU act as separate controllers [verify] | Not in use (optional) |
| Porkbun LLC | Checking whether a domain name is free (no customer data) | Domain names being searched | USA | No personal data | Not in use (optional) |
| Resend, Inc. (planned email provider) Planned; [accept the Resend DPA before enabling]. | Sending account emails (verification, password reset) and lead notifications to customers | Customer email address, name and the email content | USA | [EU-US Data Privacy Framework / SCCs — verify] | Not in use (optional) |
Other recipients (not sub-processors)
These services receive limited data as independent parties. None of them receives customer account data or visitors’ contact-form messages.
| Service | Why | What they receive | Location |
|---|---|---|---|
| Wikipedia and the business’s own website | Keyless business research, requested by our server (identified as VibeToAppBot; robots.txt respected) | Only the business name/website being researched; requests come from our server, not from users’ browsers | Various |
| Unsplash / Pexels | Stock photos for generated sites (searched and downloaded by our server, then served from our own image proxy) | Photo search terms only — no visitor or customer personal data | USA / Germany |
| Let’s Encrypt (ISRG) via Caddy | Issuing TLS certificates for published sites and custom domains | Domain names (published in public Certificate Transparency logs) | USA |
| Cloudflare DNS, Google Public DNS, RDAP / IANA | Checking domain availability and DNS setup of custom domains | Domain names | USA / global |
| Google Maps (Google Ireland Ltd / Google LLC) | Maps on published sites — loaded only after a visitor clicks “Show map” | The visitor’s IP address and browser data, sent by their browser after the click | EU / USA |
What visitors’ browsers load on published sites
Only the site’s own origin: HTML, CSS, self-hosted fonts and images served through our image proxy, plus the cookieless page-view counter and the contact form, which post to VibeToApp. Google Maps is loaded only after the visitor clicks “Show map”. Links to social networks are plain links.
Questions
Email [email protected]. To be notified of changes, keep your account email up to date — we notify all customers about changes to this list.