BizBuilder — Sub-processors
Last updated: 2026-06-04 · Status: Beta (counsel review pending)
This is the live list of services BizBuilder uses to operate the product. Each one processes some category of your data on our behalf. We update this list when we add new processors with at least 30 days' notice for material additions.
Subscribe for change notifications: [subscribe button — Backend wires to a Resend list].
Each sub-processor is bound by a Data Processing Addendum (DPA) consistent with GDPR Article 28 and applicable cross-border transfer requirements.
Always-on production processors
Every founder hits these from the moment you submit a Probe.
| Sub-processor | Role | Data categories | Region | DPA |
|---|---|---|---|---|
| Anthropic | LLM inference (Claude Haiku 4.5 + Sonnet 4.6) | URLs, page content (via Firecrawl), brand-voice corpus, scout and conjunction prompts | US | DPA |
| Supabase | Database + Row-Level Security + auth (email + Google OAuth) | Account, venture data, telemetry, encrypted credentials | US | DPA |
| Vercel | Hosting + CDN + autodeploy | HTTP request metadata, deployment logs, function execution logs | US (edge global) | DPA |
| Stripe | Payment processing (BizBuilder's own subscription billing + ad-media pass-through invoicing) | Founder email, subscription state, weekly ad-media invoice line items | US | DPA |
| Inngest | Durable workflow orchestration | Event payloads (venture ID, conjunction ID, action names, telemetry events) | US | Available via Inngest dashboard |
| Resend | Transactional email | Recipient email, subject, body, send-time metadata | US (via Amazon SES) | DPA |
| Upstash | Redis (rate limiting + alert idempotency) | Ephemeral counters, hashed identifiers; no PII content | US | DPA |
| Sentry | Error monitoring | Stack traces, breadcrumbs, request context (sensitive headers redacted), founder_id_hash (never raw email) | US | DPA |
| Firecrawl | URL scraping (auto-review and scout input) | Founder-pasted URLs (sent) → page HTML/text (returned) | US | Available via Firecrawl support |
Founder-discretionary read access (you connect; we read with scoped permissions)
These are services where you remain the data controller; BizBuilder reads via your explicit scoped-token grant. They are not BizBuilder sub-processors in the GDPR Article 28 sense; we list them here for transparency about what we touch on your behalf.
| Mechanism | Scope | When it activates |
|---|---|---|
| Stripe Restricted API Key paste-in | Read-only on 4 resources: Customers, PaymentIntents, Subscriptions, Charges | When you paste a key in Settings → Integrations (Terms §7) |
| Vercel Analytics API token paste-in | Scope: analytics:read only | When you paste a token in Settings → Integrations |
| DNS provider (GoDaddy, Namecheap, Cloudflare, etc.) | You execute DNS changes yourself via hand-off prompts; no credentials transmitted to BizBuilder | When BizBuilder generates a hand-off prompt for a DNS task |
You may revoke any of these tokens at any time directly with the provider; BizBuilder loses access immediately on revocation.
Channel adapters (conditionally enabled based on your channel configuration)
These fire only when the corresponding channel adapter is enabled in your venture configuration. We use BizBuilder's own verified ad-platform accounts for paid distribution; you fund the ad budget via the pass-through-at-cost mechanism per Terms §4.
| Adapter | Status | Region |
|---|---|---|
| Microsoft Advertising (Bing Ads) | LIVE | US |
| Google Ads | Not yet wired | — |
| Reddit Ads | Not yet wired | — |
| X (Twitter) Ads | Not yet wired | — |
| Meta Ads (Facebook / Instagram) | Not yet wired | — |
When a new channel adapter is wired and enabled in production, this list is updated and subscribed founders receive a notification.
How updates work
Material changes — adding a new sub-processor, changing a sub-processor's role or data categories, or changing the jurisdiction in which a sub-processor processes data — trigger:
- An email to founders subscribed to this list, sent at least 30 days before the new processor handles your data
- An updated "Last updated" date at the top of this page
- An entry in the change log below
You may object to a material change by replying to the notification email; if we cannot accommodate your objection, you may cancel your subscription before the change takes effect with a pro-rated refund for the unused subscription period.
Non-material changes — updates to a DPA URL, sub-processor's published policies, or formatting — are reflected in the table without a 30-day notice but appear in the change log.
Change log
| Date | Change |
|---|---|
| 2026-06-04 | Initial publication of live sub-processor list (companion to Privacy Policy v2) |
Contact
- Privacy questions:
privacy@bizbuilderai.com - Sub-processor change subscription: subscribe via the button above, or email
privacy@bizbuilderai.comwith subject "Subscribe: subprocessor changes"
BizBuilder, Inc. · Delaware C-corporation