# Sub-processors

Last updated: August 20, 2026

The third parties that process personal data to run Starlight, where they are, and how we notify you of changes.

A sub-processor is a third party that processes personal data on Starlight's behalf to deliver the Service. This page is the authoritative list referenced by our [Privacy Policy](/privacy) and incorporated as Annex 3 of our [Data Processing Addendum](/dpa). Every vendor here is bound by a written agreement with data-protection obligations at least as protective as the DPA, and none may use personal data to train AI models.

> **Info:** Safeguard column: **DPF** means the vendor is certified under the EU-US Data Privacy Framework (and its UK and Swiss extensions); **SCCs** means we rely on the EU Standard Contractual Clauses with the UK Addendum; **None required** means the vendor receives no personal data from Europe in a form that constitutes a restricted transfer (for example, keyword queries or company domains only).

## Infrastructure

| Sub-processor | Purpose | Data shared | Location | Safeguard |
| --- | --- | --- | --- | --- |
| [Vercel, Inc.](https://vercel.com/legal/privacy-policy) | Application hosting, serverless compute, cookieless analytics, and the AI Gateway that routes our model calls | All application traffic, request logs, model prompts in transit | United States | DPF |
| [Supabase, Inc.](https://supabase.com/privacy) | Authentication and the production Postgres database (AWS us-east-2) | Account data and all application data at rest | United States | DPF |

## AI models

| Sub-processor | Purpose | Data shared | Location | Safeguard |
| --- | --- | --- | --- | --- |
| [Amazon Web Services, Inc. (Amazon Bedrock)](https://aws.amazon.com/privacy/) | Hosts the primary outreach-writing model (Moonshot AI's Kimi K2.5) in AWS US regions. Starlight pins every writer call to this host through the Vercel AI Gateway, so prompts never reach Moonshot AI's own API | Prospect business context, your product and brief, cached research facts | United States | DPF |
| [Meta Platforms, Inc.](https://www.meta.ai/) | Judging, planning, and chat agent reasoning (Muse Spark) | Prospect business context, drafts being evaluated, your instructions to the agent | United States | DPF |
| [xAI Corp.](https://x.ai/legal/privacy-policy) | Research, web and X search, query parsing, signal and social scanning (Grok) | Prospect names and companies for research, search queries, public post text | United States | SCCs |
| [Anthropic, PBC](https://www.anthropic.com/privacy) | Outage fallback for the writer and judges (Claude) | Same as the model it stands in for | United States | DPF |
| [Google LLC](https://policies.google.com/privacy) | Grounded reply drafting with Google Search (Gemini); also the Gmail and Calendar APIs you connect | Reply threads being drafted, prospect context | United States | DPF |
| [OpenAI, L.L.C.](https://openai.com/policies/privacy-policy/) | Draft revision pass and outreach fallback tier (GPT-5.6) | Drafts being revised and their prompt context | United States | DPF |

## Lead and company data

| Sub-processor | Purpose | Data shared | Location | Safeguard |
| --- | --- | --- | --- | --- |
| [Apollo.io (ZenLeads Inc.)](https://www.apollo.io/privacy-policy) | Lead search, contact and company enrichment, phone reveals, job-change detection | Search filters, names, companies, LinkedIn URLs submitted for matching | United States | SCCs |

## Email and verification

| Sub-processor | Purpose | Data shared | Location | Safeguard |
| --- | --- | --- | --- | --- |
| [Resend, Inc.](https://resend.com/legal/privacy-policy) | Transactional email from Starlight itself (welcome, invites, notifications, booking confirmations) | Recipient name and email, message content | United States | SCCs |
| [Clearout](https://clearout.io/privacy-policy/) | Email address verification before a draft is sent | Recipient email addresses | India | SCCs |

## Payments

| Sub-processor | Purpose | Data shared | Location | Safeguard |
| --- | --- | --- | --- | --- |
| [Stripe, Inc.](https://stripe.com/privacy) | Subscription billing, hosted checkout, and the billing portal | Billing name, email, payment method (card numbers never reach Starlight) | United States | DPF |

## Social and web search

| Sub-processor | Purpose | Data shared | Location | Safeguard |
| --- | --- | --- | --- | --- |
| [SerpApi, LLC](https://serpapi.com/legal) | Google Maps results for Local search; Google results for Reddit threads and G2/Capterra reviews | Search queries (business types, locations, keywords); no account data | United States | None required |
| [HarvestAPI (Aventra Technologies Limited)](https://harvestapi.io/) | LinkedIn public post search for Social listening | Keyword phrases; no account data | Hong Kong | None required |
| [Reddit, Inc.](https://www.reddit.com/policies/privacy-policy) | Reddit Data API to read the full text of public threads surfaced in Social | Thread identifiers; no account data | United States | None required |

## Maps and media

| Sub-processor | Purpose | Data shared | Location | Safeguard |
| --- | --- | --- | --- | --- |
| [Logo.dev](https://logo.dev/privacy) | Company logos shown in the app | Company domain names only | United States | None required |
| [MapTiler AG](https://www.maptiler.com/privacy-policy/) | Map tiles for Local search and the Metrics globe, loaded by your browser | Your IP address and the map area viewed | Switzerland | None required |
| [OpenStreetMap Foundation (Nominatim)](https://osmfoundation.org/wiki/Privacy_Policy) | City boundary outlines for Local search, fetched server-side | Place names only | United Kingdom | None required |

### Notes

- **Amazon Web Services, Inc. (Amazon Bedrock)**: Bedrock does not store prompts or completions and does not use them to train models. The model weights are Moonshot AI's; Moonshot receives no data.
- **HarvestAPI (Aventra Technologies Limited)**: Receives only the keyword phrases compiled from your listening skill, never names, emails, or account data, so no personal data is transferred to it.

## Services You Connect

These are your own providers. Starlight exchanges data with them only when you connect an account and only on your instruction, under your agreement with that provider. They are listed for completeness and are not sub-processors.

| Service | Purpose | Data exchanged |
| --- | --- | --- |
| Gmail and Google Calendar | Send outreach, read replies to threads Starlight started, sync meetings | Outreach messages, reply threads, calendar events |
| Microsoft Outlook and Microsoft 365 Calendar | Send outreach, read replies to threads Starlight started, sync meetings | Outreach messages, reply threads, calendar events |
| HubSpot, Salesforce, Attio | Two-way contact sync with your CRM | Contact and company records you choose to import or export |
| LinkedIn, X, Reddit (via the Chrome extension) | Deliver approved messages and read your own messaging and search results in your browser | Nothing is sent to these platforms by Starlight's servers; see the Chrome Extension section of the Privacy Policy |

## How We Notify You of Changes

- Before a new sub-processor begins processing personal data, we update this page and email the owner of every workspace at least **15 days** in advance
- You may object on reasonable data-protection grounds within that window by emailing [legal@joinstarlight.com](mailto:legal@joinstarlight.com). If we cannot resolve the objection, you may terminate the affected Service as your remedy, as set out in Section 7 of the [DPA](/dpa)
- Replacing a vendor with an equivalent one, or a vendor changing its own corporate name or hosting region, is announced the same way

## Change Log

| Date | Change |
| --- | --- |
| August 20, 2026 | First published as a standalone list. Added Amazon Web Services (Bedrock, which hosts the Kimi K2.5 writer model), Meta Platforms, OpenAI, Resend, Clearout, SerpApi, HarvestAPI, Reddit, Logo.dev, MapTiler, and OpenStreetMap Foundation, all of which were already in use but were missing from the table in the Privacy Policy. Writer-model calls were pinned to the Bedrock host the same day; before that the Gateway could route them to Moonshot AI's own API. |