Subprocessors

Infrastructure and storage

Subprocessor	Purpose	Personal Data processed	Region
Supabase, Inc.	Managed PostgreSQL, authentication, file storage.	Account data, test configurations, variant content, analytics events, hashed credentials.	United States (AWS-backed).
Vercel, Inc.	Hosting for the dashboard, marketing sites, and script-API; Vercel Blob storage; Vercel AI Gateway.	Request metadata, logs, screenshots, rendered HTML, prompts.	United States (AWS-backed); global edge.
Railway Corp.	Container hosting for Python automation API and Playwright runtime.	Request metadata, transient page captures.	United States.

AI and inference

Subprocessor	Purpose	Personal Data processed	Region
Anthropic, PBC	LLM inference (Claude) via Vercel AI Gateway.	Page HTML, page descriptions, prompts.	United States.
Google LLC (Gemini)	LLM inference via Vercel AI Gateway and direct API.	Page HTML, page descriptions, prompts.	United States.
OpenAI, L.L.C.	LLM inference for variant generation and the in-product AI search assistant.	Page HTML, page descriptions, prompts.	United States.
Mistral AI	Alternative LLM provider via Vercel AI Gateway.	Page HTML, page descriptions, prompts.	France / European Union.
xAI Corp.	Alternative LLM provider via Vercel AI Gateway.	Page HTML, page descriptions, prompts.	United States.
Perplexity AI, Inc.	Web-search-augmented research assistant inside the dashboard.	Research queries.	United States.
Fal AI, Inc.	AI image generation for variant creative.	Prompts and generated images.	United States.

Payments and billing

Subprocessor	Purpose	Personal Data processed	Region
Stripe, Inc.	Payment processing, subscription billing, customer portal.	Name, email, billing address, payment-method metadata. (Card data handled by Stripe; not stored by Keak.)	United States, with global processing as required.

Communications

Subprocessor	Purpose	Personal Data processed	Region
Resend (Resend.com Inc.)	Transactional email delivery.	Customer email address, message content.	United States.
Slack Technologies, LLC	Customer notifications, support handoffs, and Slack-based integrations.	Customer email and selected event data routed to the customer's Slack workspace at their direction.	United States.

Product analytics, security and monitoring

Subprocessor	Purpose	Personal Data processed	Region
PostHog, Inc.	Product analytics, session replay, error tracking inside the Keak dashboard.	Pseudonymous user IDs, page views, event metadata, IP (truncated).	United States or EU at customer election.
Microsoft Clarity (Microsoft Corp.)	Session-level behavioural analytics on the Keak dashboard for support diagnostics.	Pseudonymous session recordings of the Keak dashboard, click and scroll events, browser metadata.	United States.
Cloudflare, Inc. (Turnstile)	Bot protection on the public sign-up form.	IP address and transient browser fingerprint signals.	Global edge.

Scheduling

Subprocessor	Purpose	Personal Data processed	Region
Cal.com, Inc.	Customer meeting and demo scheduling embedded in the dashboard and docs.	Name, email, scheduling preferences.	United States / European Union.

Identity providers (OAuth)

Customers and Keak staff may sign in via OAuth. These providers authenticate users but do not act as ongoing data processors for Customer Data: Google, Microsoft / Azure AD, Slack, and Meta (Facebook).

Internal-only tools

These tools support Keak operations and are listed for completeness. They do not process Customer Data: GitHub (source code, CI), Linear (internal issue tracking), and a team password manager (Keak-internal shared credentials).

Standard contractual safeguards

Where data is transferred outside the European Economic Area or the United Kingdom, Keak relies on:

Adequacy decisions where they exist (e.g., Canada ↔ EU).
The 2021 Standard Contractual Clauses (SCCs).
The EU-US Data Privacy Framework (Keak is in the process of self-certification; several subprocessors are already certified).

Notification of changes

Material additions or replacements of subprocessors will be announced on this page at least 30 days before they take effect. Customers may object to a new subprocessor by emailing support@keak.com.