Legal
Subprocessors
Every third party that touches data on our behalf, what it does, and where it holds it. New entries are announced here thirty days before they begin processing.
Last updated September 27, 2026. Referenced by the data processing agreement as its list of authorized subprocessors.
This page is also available in French, Spanish, Italian and German for convenience. If a translation differs from this English version, the English version prevails.
Processing your visitors' and customers' data
| Subprocessor | What it does | Where |
|---|---|---|
| Supabase Supabase Inc. |
Database, authentication and the server functions that write and read them. | Database and stored files: Frankfurt, Germany, on Amazon Web Services infrastructure. Server functions: Supabase's edge network, which may run a request outside the European Union |
| Cloudflare Cloudflare, Inc. |
Storing the recordings, serving the website and the application, and the network layer through which recordings travel. | Recordings: European Union (R2, EU jurisdiction). Website and network: global, with the point of presence nearest the visitor |
Processing your own account data
| Subprocessor | What it does | Where |
|---|---|---|
| Stripe Stripe, Inc. |
Subscriptions and payment. Card details go to Stripe directly and never reach our systems. | United States and Ireland |
| Resend Resend, Inc. |
Sending your alerts, daily reports and account emails to the addresses you choose. | United States |
Platforms you connect are not subprocessors
If you connect an ad or email platform (Meta, Google, TikTok, Snapchat, Pinterest, Microsoft, Reddit, Taboola or Klaviyo), Whence sends your orders to your own account on it, on your instructions. The same holds for the analytics, automation and store tools you connect (Google Analytics 4, HubSpot, Zapier, WooCommerce, BigCommerce): Whence sends events to them, or reads your orders from them, only on your instructions and into your own account. The same holds for your own Shopify store when you turn on sending captured contacts to your Shopify customers (off by default). You have your own agreement with that platform, and it uses the data under its own terms with you. See clause 5A of the data processing agreement and "Sending sales to your ad and email platforms" in our privacy notice.
Not currently engaged
We list these because they are planned rather than in place, and a subprocessors page that only becomes accurate after the fact is not worth reading.
- An AI model provider (OpenRouter, Inc., United States), to write the optional AI summary of a visitor from their recorded visits, and to answer the questions and quick AI actions (such as Performance summary or Conversion changes) that a merchant's team asks inside Whence. For a question or a quick action, it receives the question, or the fixed wording of the action, and the evidence Whence has computed for the store: open problems (type, page, severity, number of visits affected and a few visit identifiers), the latest daily report (numbers of analyzed visits and of each frustration signal) and, for traffic actions, visits by source over two weeks (visits, carts, checkouts, time on site, pages, countries, devices). Nothing derived from orders is sent when the person asking does not have the Revenue & orders permission. OpenRouter forwards each request to a model provider; we will name that provider on this page before any processing begins. For a summary, only page addresses, sources, devices, countries, order amounts and on-page events (such as the label of a clicked button) are sent. The email addresses, phone numbers and names Whence holds, and text typed into form fields, are never sent. It will not process any data before the end of the thirty day notice that starts with this listing. Whence sends AI requests to no other provider.
Being told about changes
Write to contact@usewhence.com and we will notify you by email whenever this page changes, thirty days before the change takes effect. Your right to object is set out in clause 5 of the data processing agreement.