Sub-processors
Last updated July 27, 2026
Nobody builds a platform alone. These are the companies that handle StartupFlow AI data on our behalf, and this is the whole list, not the highlights. If a service can see anything about you, it is on this page.
We publish it because you would otherwise have to email and ask, and because a founder deciding whether to upload their cap table deserves to see the answer before they do it, not after.
Amazon Web Services (AWS)
Runs the whole platform: the application servers, the database and the object storage your Data Room files sit in.
- What it can see: Everything: account details, startup profile, saved programs, applications, uploaded documents.
- Where it runs: United States (N. Virginia)
- What makes the transfer lawful: EU–US Data Privacy Framework and Standard Contractual Clauses
- Their terms: aws.amazon.com/compliance/gdpr-center/
Google Cloud (Vertex AI)
The AI that ranks programs against your profile and writes the plain-English reason next to each match.
- What it can see: Your startup profile and the text of what you ask the assistant. Not your email, and not your uploaded files unless you ask it to work on one.
- Where it runs: United States (us-central1)
- What makes the transfer lawful: EU–US Data Privacy Framework and Standard Contractual Clauses
- Their terms: cloud.google.com/terms/data-processing-addendum
Polar Software Inc.
Takes payments and manages subscriptions. Also our merchant of record.
- What it can see: Your email, subscription status, and the billing details you give them directly. Card numbers never reach us.
- Where it runs: United States
- What makes the transfer lawful: Standard Contractual Clauses
- Their terms: polar.sh/legal/privacy
Google LLC (Google Analytics 4)
Counts visits and shows us which pages founders actually use, so we can see where people give up. Only runs if you switch analytics on in the cookie banner.
- What it can see: Which pages you opened, roughly where you are from, your device and browser, and which site or campaign sent you. Never your email, your startup profile or anything you typed.
- Where it runs: United States
- What makes the transfer lawful: EU-US Data Privacy Framework and Standard Contractual Clauses
- Their terms: business.safety.google/adsprocessorterms/
Sentry (Functional Software, Inc.)
Tells us when something breaks. If you turn on session replay, it also records that session so we can watch the bug back.
- What it can see: Error messages, stack traces and the page you were on. We strip email addresses, tokens and cookies before anything is sent, and replay masks all text.
- Where it runs: United States
- What makes the transfer lawful: EU–US Data Privacy Framework and Standard Contractual Clauses
- Their terms: sentry.io/legal/dpa/
Our email provider (SMTP)
Delivers the mail we send you: password resets, deadline reminders, match alerts, deletion confirmations.
- What it can see: Your email address and the content of those messages.
- Where it runs: United States
- What makes the transfer lawful: Standard Contractual Clauses
Us
Not a sub-processor, but you should know anyway. StartupFlow AI is run from Pakistan. A very small number of us can reach production data when we have to. Debugging something you have reported, or acting on a request you have made. Access needs a named admin account, everything an admin does is logged, and those logs are kept for 24 months.
So if you are in the EEA or the UK: your data sits in the United States and is reachable by people in Pakistan. We rely on Standard Contractual Clauses with our hosting and infrastructure providers for that, and Pakistan has no adequacy decision from the European Commission. The full explanation is under “Your data leaves the EU” in the privacy policy.
What we do not use
No advertising networks. No data brokers. No analytics vendor of any kind, privacy-friendly or otherwise. No customer-support widget that loads a third-party script into your browser. We are not saying this to be smug. We are saying it because the absence of a vendor is as much a fact about your data as the presence of one, and it is not something you could verify without being told.
When this list changes
Adding a company that can see personal data means updating this page in the same change that adds it. If you want to be told before it happens rather than after, email privacy@startupflowai.com and we will add you to the notice list. That is also how the Data Processing Addendum handles it for business customers.