Legal
Subprocessors
Last updated: October 21, 2026
OrganicUsers.ai uses the providers below to deliver the service. Each receives only the data its part of the service needs, uses it only to provide that service to us, and is bound by contract to do so. This page is referenced by our Privacy Policy and incorporated into our Data Processing Addendum.
| Provider | What it does | Data it receives |
|---|---|---|
| Google (Firebase) | Authentication, database, and file storage — the application itself runs on it. | Account email and name, your company and site settings, every draft and campaign, uploaded and generated media. |
| Google (Search Console API) | Reads your search performance data, with your OAuth consent, and submits sitemaps. | Your OAuth token and the queries, pages, impressions and clicks for the property you connect. |
| Google (Indexing API) | Asks Google to crawl a page we just published for you. | The URLs of your published pages. No personal data. |
| Google (PageSpeed Insights API) | Measures page performance during a site audit. | The URLs of the pages audited. No personal data. |
| Google (Gemini API) | One of the four models queried for AI-visibility checks. | The prompts we run on your behalf and your brand and competitor names. |
| Google Cloud Run | Runs our video compile service, which stitches Studio renders together. | The image, video, voice-over and music assets of the video being compiled. |
| Anthropic (Claude) | Generates and reviews articles, Reddit replies, cold-email copy, and audit findings. | Your brand context and product information, keyword and SERP research, drafts, and the prompts behind them. |
| OpenAI | Transcribes Studio voice-overs for caption timings, and is one of the models queried for AI-visibility checks. | Voice-over audio and scripts, and the AI-visibility prompts we run on your behalf. |
| Perplexity | One of the four models queried for AI-visibility checks. | The prompts we run on your behalf and your brand and competitor names. |
| DataForSEO | Keyword volumes, SERP results, and backlink data. | Your domain and the keywords and competitor domains being researched. No personal data. |
| Smartlead | Sends and sequences cold email, and reports replies, bounces and unsubscribes back to us. | Prospect name, email address and company, the email copy, and the content of replies. |
| Winnr | Buys and configures the sending domains and mailboxes for the managed cold-email track. | The sending domain names chosen for you and the mailbox addresses created on them. |
| Monitors public threads for buying intent and posts replies you have approved. | Search terms derived from your product, and the reply text and account handle for anything you approve. We post nothing you have not approved. | |
| Stripe | Processes subscription and credit-pack payments. Card details go to Stripe, never to us. | Billing name, email, address, and payment-method details you enter in Stripe Checkout. |
| Resend | Delivers transactional notification email — a lead replying, a provisioning run that needs you. | Your email address and the content of the notification. |
| Render | Hosts the application and its background jobs. | Anything the application processes passes through it in transit. |
| Pexels | Supplies stock photography for generated articles. | The image search terms derived from the article. No personal data. |
| fal.ai | Generates every Studio image and video. | Your scene prompts and any reference or character images you upload. |
| ElevenLabs | Generates Studio voice-over. | The voice-over script and the voice you select. |
| IndexNow | Notifies participating search engines that a page you published has changed. | The URLs of your published pages. No personal data. |
| Higgsfield | A legacy video provider, used only where it is explicitly enabled for your company instead of fal.ai. | Your scene prompts and any reference images, when that override is on. |
Where they are
Most of these providers are based in the United States, so using the service transfers personal data outside the UK and the EEA. The safeguards we rely on are described under “International transfers” in the Privacy Policy.
Changes to this list
We update this page whenever a provider is added or removed, and change the date at the top when we do. Customers with a Data Processing Addendum are notified before a new subprocessor starts processing their data, and may object on reasonable data protection grounds — the DPA sets out the notice period and what happens if you object.
Questions about any provider on this list? Email privacy@organicusers.ai.