Subprocessors
Last updated July 5, 2026
granvl uses the following third-party subprocessors to provide the Service. A subprocessor is a vendor that processes personal information on our behalf as part of operating granvl. This page is the authoritative, current list referenced by our Data Processing Agreement; we update it before adding or replacing a subprocessor and give customers notice as described below.
1. Core infrastructure
These vendors process data as part of running the platform for every workspace.
| Subprocessor | Purpose | Data it touches | Location |
|---|---|---|---|
| Vercel | Hosting, CDN/edge network, serverless compute, scheduled jobs, page cache | All request traffic, including visitor IP addresses (transient); geolocation derived from Vercel’s own request headers — we perform no third-party IP lookups | United States |
| Supabase | Postgres database and file storage for customer page assets | Account data (users, teams), funnel and page content, pseudonymous analytics events, encrypted integration tokens | United States (us-west-2) |
| WorkOS | Authentication (AuthKit) | User emails, names, and sessions | United States |
| Upstash | Redis — rate limiting and visitor-salt infrastructure | Hashed and transient identifiers only | United States |
| PostHog (US cloud) | Product analytics about granvl’s own dashboard users (not about customers’ page visitors); error sourcemaps | Platform-user events (team and user IDs, feature usage) | United States |
| OpenRouter | Internal LLM used for funnel analysis, daily briefs, and insights | Aggregate analytics text (no visitor PII by design); its downstream model providers act as sub-subprocessors | United States |
| Resend | Transactional email (invites, weekly digests, funnel alerts) | Workspace-member email addresses and aggregate workspace statistics | United States |
| GitHub (Microsoft) | Source hosting, CI, and encrypted nightly database-backup artifacts (30-day retention) | Production database backups | United States |
2. Customer-connected integrations
These platforms process data only when you connect or configure them for your workspace, and only for that workspace.
| Platform | When it applies | Data it touches | Location |
|---|---|---|---|
| Meta Platforms | Only when you connect a Meta ad account: ad-account and spend sync in; server-side Conversions API events out, using your own pixel and token | Ad entities, spend, and creative metadata; conversion events you direct us to send | Global |
| PageSpeed Insights API (public page URLs only); GA4 Measurement Protocol when you configure it | Page URLs; conversion events you direct us to send | Global | |
| TikTok | Events API, only when you configure it | Conversion events you direct us to send | Global |
3. What is not a subprocessor
granvl is designed so that the most sensitive data path — your visitors’ form submissions — does not pass through our servers at all:
- —Form destinations (Formspree, Zapier, GoHighLevel, HubSpot, ActiveCampaign, LeadProsper, Forms.app, your own webhooks or database) are recipients you choose. Form data is sent from the visitor’s browser directly to your chosen destination — granvl servers are never in that data path, so these providers are your vendors, not our subprocessors.
- —Shopify is an inbound, customer-configured source of order values — it does not process data for us.
- —Page generation by your own AI agent (for example Claude) happens through your agent and your account with that provider; granvl does not proxy or process those interactions.
4. Changes to this list
We will update this page before engaging a new subprocessor or materially changing an existing one, and will notify workspace owners by email at least 30 days before the change takes effect for their data. If you have a reasonable, data-protection-related objection to a new subprocessor, contact us within that period and we will work with you in good faith; if we cannot offer an alternative, you may terminate the affected service and we will delete your data as described in our Privacy Policy.
5. Contact
Questions about this list or our vendors: privacy@granvl.com.
granvl · British Columbia, Canada