Legal
Subprocessors
Effective 8 September 2026.
These are the third parties Siddesh Patil uses to run the service. Each is engaged under a written data processing agreement, and each is bound to protections no weaker than those in our DPA.
We give at least 30 days' notice before adding or replacing a subprocessor: this page is updated and merchants are emailed. Merchants may object on reasonable data protection grounds — see clause 5 of the DPA.
| Subprocessor | What it is used for | Region |
|---|---|---|
| Vercel Inc. | Application hosting, scheduled jobs, and image hosting for article artwork | United States (global edge network) |
| Neon Inc. | Managed Postgres: all application data described in this policy | United States |
| Clerk, Inc. | Account sign-in, session management and identity for the web account: your email address, the credentials or social sign-in you choose, and the session token in your browser | United States |
| OpenRouter, Inc. | Single gateway for every model call: article generation and quality gates, AI-visibility probes, and topic embeddings. OpenRouter routes requests to Anthropic (directly or through Google Vertex AI and Amazon Bedrock hosting the same model) and the other model providers behind the assistants we measure, as its own sub-processors. Training on paid endpoints is disabled on our account; zero-data-retention routing is not yet enabled — see the note under the table on /subprocessors | United States |
| kie.ai | Article artwork: turning one of your product photos into an article hero, and — for a catalog with no usable photograph — generating a hero from a text description of your brand and the article's subject | United States |
| TypeSafe AI, Inc. | Editorial-readiness and video-relevance judgments on the WordPress autopilot's own work: the draft article text, its title, the buyer question it answers, the product titles, prices and types linked from it, and your brand's allowed-claim and banned-term lists. TypeSafe answers bounded questions and writes no copy. For the public AI visibility check it may also be sent a store's domain, brand name and homepage title and description, with one AI answer excerpt, to choose the store's category or confirm whether an ambiguous brand name means that store. Zero-data-retention is not enabled on our plan; TypeSafe states that its services are hosted in the United States | United States |
| DataForSEO OÜ | The public AI visibility check at /check: the store domain being checked and the generated buyer questions for its category may be sent to DataForSEO, which returns the answers ChatGPT gives to those questions. The store's name is matched in the answers afterwards and is not sent. No personal data is included | Estonia (EU); DataForSEO names infrastructure providers in Germany and the United States |
| Google LLC | Search Console API: clicks, impressions and positions for pages the app published, only where the merchant connects the property | United States |
| Resend (Plus Five Five, Inc.) | Transactional email: report confirmations, digests and receipts | United States |
| PostHog, Inc. | Product and website analytics: the server-side funnel events described in the privacy policy, and a cookieless first-party script on the public pages of citelift.app that reports page views, when a page is left and how fast it loaded. No cookie, nothing stored in your browser, and no advertising pixel | United States |
| Functional Software, Inc. (Sentry) | Error monitoring. Stack traces and request context, with secret-shaped values masked before they are sent | United States |
WordPress billing provider
Invited WooCommerce and WordPress subscriptions use Dodo Payments hosted checkout and billing portal. Dodo receives the payment and billing details a buyer enters there; Citelift receives provider identifiers and verified subscription, payment and cancellation status. Card details are not sent to Citelift. Dodo's role and notices for payment processing are presented in its hosted checkout; this page does not classify that independent payment role as a Citelift subprocessor.
Changes to this list
- 11 October 2026 — Perplexity removed. Citelift no longer sends visibility questions to Perplexity, through OpenRouter or directly. Earlier answers stay with their reports. Nothing was added, so no notice period applies.
- 26 September 2026 — DataForSEO added. DataForSEO OÜ answers the public, login-free AI visibility check at /check: it receives the store domain being checked and three generic buyer questions for that store's category, and returns what ChatGPT and Perplexity answer. No personal data and no merchant account data is sent. TypeSafe, already listed, may also be asked to choose a store's category or confirm an ambiguous brand name for the same check. This entry is the notice required by clause 5 of the DPA: for controllers already under that agreement the addition takes effect on 26 October 2026, and an objection on reasonable data protection grounds can be made to siddesh@citelift.app before that date.
- 25 September 2026 — PostHog's purpose widened. PostHog was already listed for server-side analytics. It now also receives what a cookieless first-party script on our public pages reports: page views without query strings, the linking site's domain, browser and device type, when a page is left, and page-loading speed. The script sets no cookie and stores nothing in the browser, and never runs in the signed-in workspace, the embedded Shopify app or private report links. No new subprocessor was added.
- 22 September 2026 — TypeSafe AI, Inc. added. TypeSafe answers the two decisions the WordPress autopilot makes about its own drafts: whether a candidate video is really about the article, and whether a finished draft is editorially ready for you to read. The draft text, its title, the buyer question, the linked products' titles, prices and types, and your allowed-claim and banned-term lists travel with that question. This entry is the notice required by clause 5 of the DPA: for controllers already under that agreement the addition takes effect on 22 October 2026, and an objection on reasonable data protection grounds can be made to siddesh@citelift.app before that date.
- 21 September 2026 — Clerk, Inc. added. Clerk runs sign-in, sign-up and session management for the Citelift web account, which it has done since web accounts shipped; it was missing from this table and is now listed. This entry is the notice required by clause 5 of the DPA: for controllers already under that agreement the addition takes effect on 21 October 2026, and an objection on reasonable data protection grounds can be made to siddesh@citelift.app before that date.
About the model vendors
Every large language model call — article generation, quality gates, the ChatGPT visibility probes, and topic embeddings — is made through OpenRouter, which is our contracting party. OpenRouter routes requests to Anthropic and the other model providers behind the assistants we measure, as its own sub-processors. No merchant data is used to train any model.
One vendor sits outside that gateway. TypeSafe is reached directly, and is asked questions rather than for copy: whether a candidate video is about the article, and whether a finished WordPress draft is editorially ready for you to read. The draft text and the catalog rows it names travel with the question. Zero-data-retention is not enabled on our TypeSafe plan, and we would rather say so than claim a control we have not bought.
DataForSEO is reached directly too, and only by the public AI visibility check. It may be sent the store domain and generic buyer questions, never a person's details, and returns the ChatGPT answers to them.
What we can show, rather than assert:
- Requests to Claude — article generation and the quality gates — are served by the endpoint OpenRouter selects for that model: Anthropic itself, or a cloud host of the same model such as Google Vertex AI or Amazon Bedrock. Every request carries our no data collection instruction to the provider.
- The AI-visibility probes reach the ChatGPT models deliberately. Measuring what that assistant answers about a store is the whole point of the probe, so those calls cannot be pinned anywhere else.
- Training on paid endpoints is disabled on our OpenRouter account.
- Zero-data-retention routing is not yet enabled on that account. Earlier versions of this page said it was requested; that was more than we could show, and this is the correction. When the setting is enabled, this list will say so and give the date it was turned on.
Infrastructure that is not a subprocessor
Shopify and WordPress hosting providers are not listed as our subprocessors: the merchant's relationship with each platform or host is their own, and Citelift acts on data that platform already holds for the merchant.
Questions
Write to siddesh@citelift.app.