Loading…
Every vendor that processes personal data on our behalf. This is the list our privacy policy refers to when it says we share data only with vendors strictly needed to run the service.
| Vendor | Purpose | What they receive | Location | DPA |
|---|---|---|---|---|
| Supabase | Database and authentication | Account record and every script you save | United States | In force |
| Vercel | Application hosting | Requests to the app, including IP address at the edge | United States | Being finalised |
| Anthropic | AI model provider | The context you send when you invoke an AI feature | United States | In force |
| Paddle | Merchant of record — payment, tax, invoicing | Payment details and billing address (we never see the card) | United Kingdom / European Union | In force |
| RevenueCat | In-app purchase validation (iOS app) | Apple transaction identifiers and your Arqo user ID. Never payment details or script content | United States | Being finalised |
| Liveblocks | Realtime collaboration | Presence, document operations, user identifiers | United States | In force |
| Resend | Transactional and lifecycle email | Email address and message content | United States | In force |
| Sentry | Error tracking | Scrubbed error reports; masked replay of crashing sessions | United States | Being finalised |
| PostHog | Product analytics (only with your consent) | Event names, identifiers and counts — never script content | United States | Being finalised |
| Vercel Analytics | Web analytics (only with your consent) | Page views and performance timings, in aggregate | United States | Being finalised |
| Upstash | Rate limiting | A one-way hash of your IP address | United States | In force |
| Google, Apple, Mozilla push services | Push notification delivery (only if you turn it on) | Device token and notification text | United States | N/A |
We update this list before adding or replacing a subprocessor. If your contract with us requires notice of changes, we will give it in line with that contract. "In force" means the vendor’s data processing agreement forms part of their standard terms and took effect when we opened the account. "Being finalised" means the vendor requires a separate signature that we are completing before launch.