Last updated: August 10, 2026
This page identifies third parties that may process Customer Personal Data for UGC Pulse when we act as a processor or service provider. It also separates independent controllers and planned or conditional providers so their roles are not overstated.
1. How to read this list
"Current" means the provider is approved for and may be used in the stated service. "Conditional" means the provider receives data only if configured or activated for the relevant environment or feature. A conditional listing is not a representation that every vendor currently receives data.
Locations identify known primary or provider-listed processing regions. Provider personnel, affiliates, support, resilience, and subprocessors may operate elsewhere, so processing locations are not exclusive. Applicable contracts and transfer safeguards govern restricted transfers.
2. Current subprocessors
| Provider | Purpose and data | Role | Location | Status and documents |
|---|---|---|---|---|
| Supabase, Inc. | Provides authentication, database, storage, and backend infrastructure. May process account details, Customer Content, product records, technical data, and security logs. | Processor or subprocessor | United States for the primary UGC Pulse production database; other provider locations may support service delivery. | Current. |
| OpenAI, LLC or the applicable OpenAI contracting entity | API-based AI processing for prompts, selected context, Customer Content sent to AI features, and generated outputs. | Processor or subprocessor | United States and other locations identified in OpenAI's current data-processing and subprocessor materials. The contracting entity may vary by customer location. | Current for AI features. Review the OpenAI DPA. |
| Peerlist Inc. d/b/a AutoSend | Provides transactional, support, onboarding, product, and marketing email. May process recipient names and addresses, message content, delivery metadata, and engagement data when enabled. | Processor or subprocessor | United States, with provider subprocessors in disclosed locations. | Current. Review AutoSend's Privacy Policy and subprocessor list. |
3. Conditional analytics subprocessors
| Provider | Purpose and data | Location | Status and documents |
|---|---|---|---|
| Google LLC | Google Analytics 4 website measurement. May process online identifiers, IP and device data, page activity, referrals, approximate location, and configured events. | Global provider infrastructure | Conditional, only if configured with a measurement identifier and permitted by current consent logic. Review Google's Privacy Policy. |
| Mixpanel, Inc. | Product analytics, feature adoption, funnels, and diagnostics. May process identifiers, device and usage data, configured events, and account or organization identifiers that UGC Pulse lawfully sends. | United States by default unless another residency option is selected; global support and subprocessor locations. | Conditional, only if configured. Review Mixpanel's subprocessor list. |
| Microsoft Corporation | Microsoft Clarity analytics, heatmaps, and masked session replay. May process online identifiers, IP and device data, page interactions, and masked recordings. | Global provider infrastructure | Conditional, only if configured. Review the Microsoft Privacy Statement. |
4. Independent controllers and other recipients
Dodo Payments Inc., together with Dodope Payments Limited and other applicable Dodo group entities, acts as Merchant of Record. Dodo states that it acts as an independent Controller for buyer transaction processing, payment facilitation, tax, fraud, sanctions screening, chargebacks, and disputes, and other duties it performs as legal seller. It is not treated as a subprocessor for those activities.
Dodo may act as a processor for limited merchant-directed services where its agreement expressly assigns that role. Review Dodo's Data Processing Agreement and Privacy Policy.
5. Public social-data provider
No public social-data provider has been selected, so no provider is listed for that role. UGC Pulse must verify the provider's platform rights, processing terms, locations, security, and transfer safeguards and update applicable disclosures before production processing begins.
6. Changes, notice, and objections
We may add, replace, or remove a provider as the Service changes. We will provide advance notice where the agreement or applicable law requires it. A customer may object within the stated notice period on reasonable data-protection grounds. We will work in good faith on an available alternative or other remedy described in the DPA.
Until an in-product notification mechanism is available, you can subscribe to change notices by emailing hello@ugcpulse.app with the subject "Subprocessor notices."
Questions about provider roles may be sent to the same address. Also review our Data Processing Addendum, Privacy Policy, and Cookie Policy.