Data Processing
Effective July 3, 2026
The plain-language summary of who does what with your data. The full detail lives in the Privacy Policy; a signable DPA is available to business customers on request.
Who is responsible for what
- For the business data you connect (your Stripe revenue, your customer records, your content): you are the controller and Cerqular is your processor. We process it only to provide the service you configured, on your instructions, and never for our own purposes.
- For your account and usage data (your email, login, telemetry): Cerqular is the controller, and the Privacy Policy governs.
Subprocessors
We use a small, named set of subprocessors. This list matches the processors section of the Privacy Policy; if we add one that touches your data, both pages update first and business customers with a DPA are notified in advance.
| Subprocessor | What it does | Location |
|---|---|---|
| Stripe | Payment processing and the revenue data you connect | United States |
| Supabase | Database hosting and storage, row-level security per account | United States |
| Anthropic | AI processing via API; excluded from model training on your data | United States |
| Resend | Transactional email | United States |
| Vercel | Web application hosting | United States |
| Render | Backend infrastructure hosting | United States |
| PostHog | Product analytics, and only if you accept analytics cookies | United States |
| Termly | Renders the long-form legal policies on our legal pages | United States |
International transfers
Processing happens in the United States. Where your data originates from a region that restricts transfers (such as the EEA, the UK, or Australia), we rely on recognized safeguards such as standard contractual clauses with our subprocessors.
Security measures, in short
Encryption in transit and at rest, AES-256-GCM encryption for stored connection credentials, row-level security isolating each account, and least-privilege internal access. The full posture is on the Trust page.
Need a signable DPA?
Business customers (including agencies processing their clients' data through Cerqular) can request our Data Processing Agreement, incorporating standard contractual clauses, at legal@cerqular.ai. We turn these around quickly.