Sub-processors
Third-party services that process data on behalf of MentionFox
Last updated: 2026-09-29
Current Sub-processors
MentionFox engages the following sub-processors to provide and improve the service. This list is kept up to date and will be updated when sub-processors are added or removed.
“Provider’s cloud” means the provider decides where its servers run; ask the provider, or legal@mentionfox.com, for its current locations. The research providers receive only what is needed to run the research you ask for.
| Sub-processor | Purpose | Data Location | Data Processed |
|---|---|---|---|
| Supabase (AWS) | Database, authentication, file storage, server functions | Sydney, Australia (ap-southeast-2) | All account and service data |
| Vercel | Website hosting, CDN, part of our server code | Global edge network | Page requests, routing, the first-party visit records our server code writes |
| Cloudflare | DNS | Global edge network | Network routing data |
| Stripe | Payment processing, subscription management | United States, EU | Payment method, billing info |
| Resend | Transactional email delivery | United States | Email addresses, message content |
| Twilio | Phone calls you place from the CRM | United States | Phone numbers, call data |
| Lovable | The Google sign-in step | Provider’s cloud | Sign-in data passed to Google |
| Anthropic | AI research, reports, drafts and content analysis | United States | Names, companies and questions you enter; research content |
| OpenAI | AI research, analysis and drafting; AI-visibility checks | United States | Names, companies and questions you enter; research content |
| Google (Gemini) | AI research and analysis; AI-visibility checks | Provider’s cloud | Names, companies and questions you enter; research content |
| DeepSeek | AI processing for research, analysis and AI-visibility checks | China | Names, companies and questions you enter; research content |
| Perplexity | AI research; AI-visibility checks | United States | Names, companies and questions you enter |
| xAI, Mistral, Groq, Cohere | AI-visibility checks (questions about the brand you track) | Provider’s cloud | Brand names and the questions asked |
| Serper, SerpApi, DataForSEO | Web search for research and content discovery | Provider’s cloud | Search queries (names, companies, domains) |
| Firecrawl, Apify, Bright Data | Reading web pages and public profiles for research | Provider’s cloud | Page addresses, names and companies searched |
| SocialData | X (Twitter) posts for social listening | Europe | Search terms; public social media posts |
| Hunter, Apollo | Company and contact look-ups for research you run | Provider’s cloud | Names, companies, domains |
| ZeroBounce | Email address verification | United States | Email addresses for validation |
| Brandfetch | Company logos | Provider’s cloud | Company domains |
| Google (Ads tag) | Measuring whether our Google ads lead to sign-ups and orders, on mentionfox.com | Provider’s cloud | Consent-denied, cookieless signals before Accept All; advertising cookies only after Accept All. Not loaded with Global Privacy Control or Do Not Track |
| Microsoft (Clarity) | Page analytics on the mentionfox.com marketing site, only after you press Accept All on the cookie banner | Provider’s cloud | How pages are used (clicks, scrolls), Clarity cookies. Not loaded before Accept All, with Essential Only, with Global Privacy Control or Do Not Track, or inside another site’s frame |
| Umami | Cookieless visit counts on some pages | EU (cloud-hosted) | Page address and title, referrer, screen size, browser language; like any web server, IP address and browser type. Not loaded with Global Privacy Control or Do Not Track |
| GetFoxChat (our sister product) | The help chat on our pages | Provider’s cloud | What you type in the chat; name and email if you are signed in |
Changes to Sub-processors
We update this page and its date whenever a provider changes.
If you object to a new sub-processor, you may terminate your MentionFox subscription without penalty within 30 days of the date this page is updated to add them by contacting legal@mentionfox.com.
Sub-processor Security Standards
All sub-processors are selected based on their security practices and compliance posture. Key certifications held by our primary sub-processors include:
| Sub-processor | Certifications / Compliance |
|---|---|
| Supabase (AWS) | SOC 2 Type II, ISO 27001, GDPR |
| Vercel | SOC 2 Type II, GDPR |
| Stripe | PCI DSS Level 1, SOC 2 Type II, GDPR |
| Anthropic | SOC 2 Type II |
| Cloudflare | SOC 2 Type II, ISO 27001, GDPR |