Legal
Subprocessors
Every outside service that receives customer data, what it receives, and when.
Last updated: October 27, 2026
01.
About this list
We built this list from the services our code actually calls. Each entry says whether it is used for every customer or only when you use a particular feature. We will update this page before adding a new subprocessor.
We have not yet verified where each vendor processes data, so the location column says so. Ask us at info@slapmyweb.com if you need it for a review.
02.
Used for every customer
Hostinger
- Purpose
- Hosts the virtual private server (VPS) that runs the website, API, worker, database, file storage and backups.
- Data
- All data we hold: accounts, scans, reports, screenshots, uploads, leads, connected-account tokens (stored encrypted) and the daily database backup.
- When
- Always
- Location
- Hostinger VPS. The data-centre region is not stated here yet.
Cloudflare
- Purpose
- DNS, CDN, TLS at the edge, and Cloudflare Web Analytics on our website.
- Data
- Every request to slapmyweb.com and api.slapmyweb.com passes through it, including visitor IP addresses and request contents.
- When
- Always
- Location
- Not yet verified by us
Resend
- Purpose
- Sends our email.
- Data
- Recipient email address and the email content: account emails, alerts, scheduled reports (with the PDF attached), and the follow-up emails agencies send to their leads (with the audit PDF attached).
- When
- Whenever we send an email
- Location
- Not yet verified by us
Experiential Labs (AI gateway)
- Purpose
- Our main AI provider. It passes each request to the model it routes to, including Anthropic Claude models and Perplexity Sonar.
- Data
- Audit results for the scanned URL (URL, scores, page title, findings); text you send to the PDF AI assistant; the questions you set for AI visibility checks (Perplexity).
- When
- When a scan writes its verdict, and when you use AI features
- Location
- Not yet verified by us
Google PageSpeed Insights and Chrome UX Report
- Purpose
- Lab speed tests and real-user speed data for audited pages.
- Data
- The URL being audited.
- When
- Every scan
- Location
- Not yet verified by us
Google Analytics (our website)
- Purpose
- Measures how visitors use slapmyweb.com.
- Data
- Visitor IP address, page views, device and browser details, and an analytics cookie identifier.
- When
- On visits to our website
- Location
- Not yet verified by us
03.
Used only with a feature
Stripe
- Purpose
- Payments and subscriptions.
- Data
- Email address, plan and Stripe customer and subscription IDs. Card details are entered on Stripe; our servers do not receive card numbers.
- When
- Paid plans only
- Location
- Not yet verified by us
Groq
- Purpose
- Backup AI provider for scan verdicts.
- Data
- The same audit summary sent to the main AI provider.
- When
- Only when the main AI provider fails
- Location
- Not yet verified by us
OpenAI
- Purpose
- AI for the writing and content tools and local SEO suggestions, and a last backup for scan verdicts.
- Data
- Text you enter into those tools, local business details you give us, and the audit summary when used as a backup.
- When
- When you use those tools, or when earlier AI providers fail
- Location
- Not yet verified by us
Google Gemini API
- Purpose
- Answers AI visibility questions with Google Search grounding.
- Data
- The questions you set for AI visibility checks.
- When
- Only when AI visibility checks run
- Location
- Not yet verified by us
Google account services (Sign-in, Search Console, Analytics 4, Slides)
- Purpose
- Google sign-in, reading your Search Console and GA4 data, and exporting a report to Google Slides.
- Data
- Your Google account email for sign-in; OAuth tokens (stored encrypted); the Search Console and GA4 properties you link; report content for a Slides export.
- When
- Only when you sign in with Google, connect Google data, or export to Slides
- Location
- Not yet verified by us
YouTube (Google)
- Purpose
- Fetches public transcripts and thumbnails for YouTube videos found on an audited page (video audit).
- Data
- The YouTube video IDs and URLs found on the audited page.
- When
- Only when the video audit finds YouTube videos (transcripts on paid plans only)
- Location
- Not yet verified by us
Microsoft Bing Webmaster Tools
- Purpose
- Reads your Bing query statistics and the backlinks Bing reports.
- Data
- Your site URL and the Bing API key you paste (stored encrypted).
- When
- Only when you add a Bing key
- Location
- Not yet verified by us
DataForSEO
- Purpose
- Keyword research, rank tracking, domain and backlink data, local business data and brand search results.
- Data
- Keywords, domains and competitor domains you enter, and business names and locations for local SEO.
- When
- Only when you use those features
- Location
- Not yet verified by us
HubSpot
- Purpose
- Sends an agency’s captured leads to its own HubSpot account.
- Data
- Lead email, name, company, website and phone number.
- When
- Only when an agency connects HubSpot
- Location
- Not yet verified by us
Cloudflare API (an agency’s own account)
- Purpose
- Applies SEO fixes as a Cloudflare Worker on a site the agency controls (beta).
- Data
- The API token you give us (stored encrypted), the zone and account IDs, and the Worker script and routes holding the fixes.
- When
- Only when an agency connects Cloudflare
- Location
- Not yet verified by us
Notion
- Purpose
- Exports a report to your Notion workspace.
- Data
- The report content you export; the OAuth token is stored encrypted.
- When
- Only when you export to Notion
- Location
- Not yet verified by us
Internet Archive (Wayback Machine)
- Purpose
- Finds old URLs for migration audits.
- Data
- The public domain being audited.
- When
- Only when you run a migration audit
- Location
- Not yet verified by us
Wikidata (Wikimedia Foundation)
- Purpose
- Matches brands and entities for entity and brand checks.
- Data
- Brand and entity names found on the audited site.
- When
- Only when entity or brand checks run
- Location
- Not yet verified by us
04.
Destinations you choose
Webhooks you set up (your own endpoints, Slack or Discord) receive exactly what you configure them to receive. They are recipients you choose, not our subprocessors. The websites you audit are fetched directly from our server.