Vensor uses the companies in the first table below to run the product. Each one is bound by contract to protect your data, to use it only to provide the service to us, and to meet the same obligations we owe you. They are not free to use your data for their own purposes, with one exception: Cloudflare also uses the signals from its Turnstile security check to improve that check.
Sub-processors
Last updated: October 1, 2026
Who we use, and what for
| Company | What they do for us | What they can see | Where |
|---|---|---|---|
| Supabase | Database, authentication and file storage | Account data, synced ticket records, policy documents you upload or copy from Notion, Confluence or Google Drive, and encrypted access tokens for services you connect | United States |
| OpenAI | Analysis of ticket content against your policies, and reading public information about your company when you sign up | Ticket text, with personal details removed before sending; the text of your SOPs, including SOPs copied from Notion, Confluence and Google Drive; publicly available company information | United States |
| Cloudflare R2 | File storage for the policy documents you upload | Uploaded policy documents and images taken from them, including any personal details they contain | Global |
| Microsoft Azure | Reading text from images in the policy documents you upload | Uploaded images and images taken from uploaded policy documents, including any personal details they contain | United States |
| Brandfetch | Finding your company's logo and brand details when you sign up | Your company name and website domain | Switzerland |
| Jina AI | Reading your company's public website when you sign up | Your company's website address and its public pages | Germany |
| Vercel | Application hosting and content delivery | Request metadata, IP addresses, and the content of PDF, Word and PowerPoint files you choose in Google Drive while we convert them to text (not stored) | United States |
| Resend | Email delivery, including account and password-reset messages | Recipient name and email address, and the confirmation and password-reset links each message carries | United States |
| Stripe | Subscription billing and payment processing | Billing contact details and payment information | United States |
| PostHog | Product analytics, to see which features are used, and analytics for our marketing website | Account events and account identifiers sent from our servers; on our marketing website, pages viewed, clicks, heat maps and session recordings (with typed characters hidden), browser and device details, and possibly IP address | United States |
| Cal.com | Booking demo calls from our marketing website | The name, email address and anything else you enter when you book a call, and technical details such as IP address and browser from its booking script and window | United States |
| Cloudflare Turnstile | Security checks on our sign-up, sign-in and password reset pages, to tell people apart from automated scripts | IP address and browser and device signals from those pages | Global |
Advertising and visitor identification partners
We use the companies below on our marketing website, and LinkedIn and Meta also when you sign up. We never send them anything from inside the Vensor app, and never ticket content. Unlike the companies above, they are not only service providers to us. LinkedIn, Meta, RB2B and LiveIntent each also use what they receive for their own purposes, under their own privacy policies. LinkedIn uses it to measure and target our ads and, in a form that does not directly identify you, to improve its own services. Meta uses it to measure and target ads and to personalize the ads and other content it shows you. RB2B and LiveIntent use it to identify visitors and to maintain the identity and contact information they provide to their other customers. ip-api keeps the IP addresses it receives in its access logs for up to 24 hours, and AtData, Demandbase and the other companies RB2B works with may also use what they receive for their own purposes. Section 2 of our privacy policy explains what each one receives, when we do not use them, and how to opt out.
| Company | What they do for us | What they can see | Where |
|---|---|---|---|
| Measuring our advertising and showing our ads to people who visited our marketing website | From visits to vensor.ai: the page address and title, the referring page, IP address, browser and device details and LinkedIn's own cookie identifiers. At sign-up, through LinkedIn's Conversions API: a hashed form of the sign-up email address, which LinkedIn can match to a LinkedIn account, LinkedIn's ad click ID if present, the time of sign-up and a reference code for the new account. Nothing from inside the Vensor app | United States | |
| Meta | Measuring our advertising and showing our ads to people who visited our marketing website | IP address, browser details and Meta's own cookies, with the fact that a browser viewed a page on vensor.ai or completed sign-up. No page address, name or email. Nothing from inside the Vensor app | United States |
| RB2B (GetEmails, LLC) | Identifying the companies that visit our marketing website and, for visitors in the United States, the people | IP address, cookie and device identifiers, pages visited on vensor.ai, the referring page, visit times and time on each page, which RB2B matches to contact and profile details it holds: name, job title, employer and company details, business email address (or a personal email address), city, state and ZIP code, and LinkedIn profile. Nothing from inside the Vensor app | United States |
| LiveIntent | Identity resolution for RB2B on our marketing website | IP address, browser details, visit time and LiveIntent's own cookie identifiers, from visits to vensor.ai. Nothing from inside the Vensor app | United States |
| ip-api (Artia International S.R.L.) | IP location lookup for RB2B on our marketing website | IP address from visits to vensor.ai, kept in its access logs for up to 24 hours. Nothing from inside the Vensor app | Romania |
| AtData (TowerData, Inc.) | Matching browser identifiers with RB2B on our marketing website | IP address and browser and cookie identifiers from visits to vensor.ai. Nothing from inside the Vensor app | United States |
| Demandbase | Identifying the company, not the person, that visited, for RB2B on our marketing website | Visit information RB2B passes on to identify the company, such as IP address, from visits to vensor.ai. Nothing from inside the Vensor app | United States |
| Other companies RB2B works with | Matching browser identifiers with RB2B on our marketing website | IP address and browser and cookie identifiers from visits to vensor.ai. Nothing from inside the Vensor app | Not publicly documented |
What this does not mean
The companies in the first table are service providers acting on our instructions, not parties we share your data with for their own use. The advertising and visitor identification partners are different, as explained above their table. Your ticket content is never sent to them, never sold, and never used to train AI models. Before ticket text is sent for analysis, personal details are removed from it.
Changes to this list
This page is updated when a sub-processor is added or removed, and the date at the top reflects the last change. If you have a data processing agreement with us that requires advance notice, we will notify you as that agreement sets out.