Legal
Subprocessors
The companies that handle data for BotSay, what each one receives, and why. We tell customers at least 30 days before a new one starts.
Last updated 21 September 2026. Privacy
AI engines
They receive the questions you wrote, and nothing about you.
| Company | What it receives | Why | Where |
|---|---|---|---|
| OpenAI | Question text, market | Measuring how ChatGPT answers | United States |
| Anthropic | Question text, market. Separately, the stored answer text from every engine | Measuring how Claude answers, and finding brand mentions in every answer | United States |
| Question text | Measuring how Gemini answers | United States | |
| Perplexity | Question text, market | Measuring how Perplexity answers | United States |
| xAI | Question text | Measuring how Grok answers | United States |
| DataForSEO | Question text as a search query, with location and language | Reading Google's AI search results through licensed search infrastructure | Estonia |
Everyone else
| Company | What it receives | Why | Where |
|---|---|---|---|
| Caspio | All customer data, and the waiting list | The database holding every BotSay record | United States |
| Railway | Data passing through the running application, and stored measurement history | Hosting the application | United States (US West) |
| Stripe | Billing contact and card details, given by you directly to Stripe | Taking payment | United States |
| Resend | Recipient addresses and message content | Sending the Monday email, service email and waiting-list messages | United States |
| Cloudflare | Site traffic, and bot-check signals from forms | Hosting www.botsay.ai and preventing abuse | Global |
| Google (Analytics, Tag Manager) | Site visit data, only after you accept cookies | Understanding how people use www.botsay.ai | To be confirmed |
| HubSpot | Waiting-list email addresses, once confirmed | Our customer relationship system | To be confirmed |
Planned, not yet active
HubSpot, for customer accounts. We plan to send the workspace as a company and its admins and members as contacts, with the plan and its dates. Never your questions, answers or figures. Customers will get at least 30 days' notice before this starts, and may object.
This page matches Annex II of our data processing addendum, the contract document that names subprocessors for customers under contract. "To be confirmed" marks a location we have not finished settling.