Legal
Last updated: 19 October 2026
| Provider | Legal entity | Purpose | Data processed | Location | Transfer mechanism |
|---|---|---|---|---|---|
| Convex | Convex, Inc. | Application database, backend functions, file storage | Account data, chat history, content submitted, usage data | United States | UK IDTA / EU SCCs |
| Clerk | Clerk, Inc. | User authentication, session management, SSO | Name, email, password hash, profile image, session tokens, IP address | United States | UK IDTA / EU SCCs |
| Vercel | Vercel Inc. | Application hosting, edge network, serverless compute | Request logs, IP address, and any data in transit | United States (global edge network) | UK IDTA / EU SCCs |
| Stripe | Stripe Payments UK Limited | Payment processing, subscription billing, invoicing | Billing name and address, payment card details, email, VAT number, transaction history | United Kingdom; with onward transfer to Stripe, Inc. (US) | UK IDTA / UK-US Data Bridge |
| OpenRouter | OpenRouter, Inc. | AI model gateway used to generate chat responses, campaign plans, and ad copy | Prompts and content the user submits to the chat; generated output | United States | UK IDTA / EU SCCs |
| Google AI (Gemini / Imagen 4) | Google LLC | AI image generation (Imagen 4) and text generation for ad creatives | Image generation prompts and any reference imagery submitted | United States (global infrastructure) | UK IDTA / EU SCCs |
| Meta WhatsApp Cloud API | WhatsApp Ireland Limited (Meta Platforms) | Delivering Spun's conversational AI over WhatsApp, inbound and outbound messaging, message templates, media delivery, and delivery status | Phone number (E.164), display name, message content (chat with the bot), media attachments, delivery and read receipts | Ireland (EU); with onward transfer to Meta Platforms, Inc. (US) | Adequacy / EU SCCs |
| Google Analytics 4 | Google LLC (via Google Ireland Ltd. for UK/EEA users) | Website analytics to measure traffic and product usage | IP address (truncated), device and browser data, page views, pseudonymous identifiers | Ireland / United States | EU SCCs (loaded only after user consent) |
| Composio | Sampark Inc. (dba Composio) | Brokers the Google account connection for the customer book (Gmail, Calendar, Contacts): holds the Google OAuth grant and relays the read/write requests Spun makes on your instruction | Google account identifier; OAuth tokens (held in Composio's vault, not by Spun); contact names, emails and phone numbers, calendar entries and email content that Spun reads or writes on your instruction; request logs | United States | EU SCCs (Module 3) with the UK International Data Transfer Addendum, executed on acceptance of Composio's Data Processing Addendum (2 September 2026 version) |
| Resend | Resend, Inc. | Sends Spun's own emails, such as the follow-up after the hotel demo | Recipient name and email address, the email content, delivery and bounce events | United States | EU SCCs via Resend's Data Processing Addendum |
| Sentry | Functional Software, Inc. (dba Sentry) | Application error monitoring and performance diagnostics | Error and exception data, stack traces, IP address, browser and device metadata, request context | United States | UK IDTA / EU SCCs |
When you connect an advertising platform (e.g. Meta, Google Ads) and instruct Spun to launch campaigns, Spun transmits campaign data to that platform on your behalf and at your direction. Those platforms act as independent data controllers for the data you push to them: they are not sub-processors of Spun in the strict sense, but are disclosed here for transparency. You should review each platform’s own privacy and data processing terms.
Customers who wish to receive email notifications of sub-processor changes can subscribe by emailing privacy@spun.botwith the subject “Sub-processor updates”.
If you have a reasonable data protection concern about a new sub-processor, email privacy@spun.bot within the 14-day notice period. We will work with you in good faith to resolve the concern as described in our Data Processing Agreement.