Legal
Last updated: 28 April 2026
| Provider | Legal entity | Purpose | Data processed | Location | Transfer mechanism |
|---|---|---|---|---|---|
| Convex | Convex, Inc. | Application database, backend functions, file storage | Account data, chat history, content submitted, usage data | United States | UK IDTA / EU SCCs |
| Clerk | Clerk, Inc. | User authentication, session management, SSO | Name, email, password hash, profile image, session tokens, IP address | United States | UK IDTA / EU SCCs |
| Vercel | Vercel Inc. | Application hosting, edge network, serverless compute | Request logs, IP address, and any data in transit | United States (global edge network) | UK IDTA / EU SCCs |
| Stripe | Stripe Payments Europe, Ltd. | Payment processing, subscription billing, invoicing | Billing name and address, payment card details, email, VAT number, transaction history | Ireland (EU); with onward transfer to Stripe, Inc. (US) | Adequacy / EU SCCs |
| OpenRouter | OpenRouter, Inc. | AI model gateway used to generate chat responses, campaign plans, and ad copy | Prompts and content the user submits to the chat; generated output | United States | UK IDTA / EU SCCs |
| Google AI (Gemini / Imagen 4) | Google LLC | AI image generation (Imagen 4) and text generation for ad creatives | Image generation prompts and any reference imagery submitted | United States (global infrastructure) | UK IDTA / EU SCCs |
| Pipedream Connect | Pipedream, Inc. | OAuth token broker for advertising platform integrations (Meta, Google Ads) | OAuth tokens and account identifiers for the ad platforms the customer connects | United States | UK IDTA / EU SCCs |
| Meta WhatsApp Cloud API | WhatsApp Ireland Limited (Meta Platforms) | Delivering Spun's conversational AI over WhatsApp — inbound and outbound messaging, message templates, media delivery, and delivery status | Phone number (E.164), display name, message content (chat with the bot), media attachments, delivery and read receipts | Ireland (EU); with onward transfer to Meta Platforms, Inc. (US) | Adequacy / EU SCCs |
| Google Analytics 4 | Google LLC (via Google Ireland Ltd. for UK/EEA users) | Website analytics to measure traffic and product usage | IP address (truncated), device and browser data, page views, pseudonymous identifiers | Ireland / United States | EU SCCs (loaded only after user consent) |
When you connect an advertising platform (e.g. Meta, Google Ads) and instruct Spun to launch campaigns, Spun transmits campaign data to that platform on your behalf and at your direction. Those platforms act as independent data controllers for the data you push to them — they are not sub-processors of Spun in the strict sense, but are disclosed here for transparency. You should review each platform’s own privacy and data processing terms.
Customers who wish to receive email notifications of sub-processor changes can subscribe by emailing privacy@spun.bot with the subject “Sub-processor updates”.
If you have a reasonable data protection concern about a new sub-processor, email privacy@spun.bot within the 14-day notice period. We will work with you in good faith to resolve the concern as described in our Data Processing Agreement.