Sub-processors
Under GDPR Art. 28 we maintain a list of every third-party processor that touches data on Grail Atlas’s behalf. This page is the canonical record. It’s updated in the same change-set as any processor change (adding, removing, or scope-shifting), and the git history is the canonical timeline.
Active today (10)
Vercel, Supabase, and Upstash are involved on every page load. Cloudflare handles DNS for every domain lookup. With analytics consent, PostHog also runs on every page. Resend handles outbound email. eBay's Browse API supplies pricing and listing data on reference pages and GPHG detail pages. Voyage AI receives query text when you use natural language search. Anthropic receives editorial prompts from the blog-draft cron job (not from visitor traffic). YouTube is contacted only if you click to load an embedded video on a reference page.
- VercelACTIVE
Role. Application hosting, edge middleware, CDN, + cookieless Web Analytics and Speed Insights (gated by visitor consent).
Data received. Request metadata (IP, user-agent, URL, response time), short-term access logs. With analytics consent: cookieless aggregate page-view count + Core Web Vitals (no persistent identifier, IP hashed + discarded after 24 hours per Vercel).
- PostHogACTIVE
Role. Aggregate traffic analytics (page views, referrer sources, country-level geography), gated by the same visitor consent as Vercel Analytics.
Data received. With analytics consent only: page views, referrer, and country-level geography. Sets a first-party cookie and a matching local-storage entry on your device once you consent, so a returning visitor can be recognized across sessions; revoking consent clears both immediately. Without consent, PostHog never initializes and no request reaches its servers.
- eBay (Browse API)ACTIVE
Role. Marketplace pricing and listing data for reference pages (daily sync) and the GPHG live-listings panel (fetched on page view). Not an analytics or advertising integration -- it is a data source, the same way Voyage AI is a data source for search.
Data received. Outbound: search text built from catalog fields (brand, model, reference) -- never a visitor identifier, IP, or query the visitor typed. Inbound: listing title, price, condition, and image URL. eBay Partner Network affiliate tagging is code-complete and will activate automatically once a campaign ID is configured; see the Affiliate disclosure page for what changes when it does.
- SupabaseACTIVE
Role. Primary database (Postgres) and authentication for any account or signup data.
Data received. For anonymous visitors: nothing. For signed-up visitors: account email, hashed password, saved searches, Grail List entries, newsletter subscriptions with proof-of-consent, and the audit-log rows that record privacy operations.
- UpstashACTIVE
Role. Redis-backed rate limiting for the mutation endpoints (newsletter signup, /request form, /privacy/request when it lands).
Data received. Rate-limit counters keyed by hashed IP. No personal identifiers.
- CloudflareACTIVE
Role. Domain registrar and DNS provider for grailatlas.com.
Data received. DNS queries for grailatlas.com: public network metadata that every DNS resolver between you and the site already sees. No site-level personal data flows through Cloudflare today.
- ResendACTIVE
Role. Outbound transactional email for account confirmation, privacy request confirmation, deletion receipts, blog digest notifications, and admin alerts.
Data received. Recipient email address and confirmation-link content. No site browsing or saved-search history.
- Voyage AIACTIVE
Role. Embedding model API used for natural language search. Query text submitted by users is sent to Voyage AI to generate a search embedding vector. No account or identity data is included.
Data received. User-submitted search query text. No account identifier, email, or saved-list data.
- AnthropicACTIVE
Role. AI model API used at authoring time (blog draft generation via weekly cron job). No visitor data is sent to Anthropic; only editorial prompts constructed from public catalog data.
Data received. Editorial prompts containing public catalog data (watch names, descriptions). No visitor email, search history, or account data.
- Google Ireland Ltd / YouTube LLCACTIVE
Role. Embedded video playback of creator reviews on reference pages, but only when a visitor clicks "Load video from YouTube." Thumbnails are proxied same-origin beforehand, so no Google host is contacted just from loading the page.
Data received. Only after an explicit click: IP address and device/browser information, disclosed directly to Google via the youtube-nocookie.com embed. Nothing about the click or the viewer is stored by us.
Configured but not transmitting (2)
Wired into the codebase or env but currently inert. Listed so the picture is honest: these names appear inpackage.json or .env.example but no line of executing code sends them data today. Each one moves to ACTIVE the day the wiring lands, with the privacy policy + ROPA updated in the same commit.
- Cloudflare R2CONFIGURED · NOT TRANSMITTING
Role. Object storage for reference photos (planned). Today, photos are served from the Vercel-hosted /public directory; R2 is documented for the eventual migration.
Data received. Photo binary fetches (no per-visitor identifier).
- RailwayCONFIGURED · NOT TRANSMITTING
Role. Background worker hosting for any reassessment / email-digest / ingest jobs (planned). No worker is currently deployed; everything is SSR on Vercel.
Data received. Service-role access to Supabase when active. No direct user identifiers stored at Railway.
Future (2)
Planned for known features. Listed so the road-map is visible rather than emerging as a surprise.
- DeepLFUTURE
Role. Machine translation of community signals authored in non-English languages. Credentials provisioned; off by default.
Data received. Short text excerpts authored by community contributors.
- MapboxFUTURE
Role. Map tiles for the Atlas geographic UI (planned).
Data received. Tile-fetch requests with approximate viewport coordinates and visitor IP at the time of the request when active.
Notable absences
Things the audience may reasonably wonder about that are not currently in use:
- OpenAI or any other LLM API at runtime. Anthropic is listed above as an active sub-processor but only for authoring-time blog drafts; no inference runs on visitor traffic.
- Google Analytics, Plausible, Fathom, Meta Pixel, TikTok Pixel, or any advertising or cross-site tracking tool. Vercel (no cookie, ever) and PostHog (first-party cookie + local storage, but only once you consent) are aggregate-analytics tools, not advertising trackers -- they don’t follow you across other sites or build an ad profile.
- Advertising networks. None wired and no current plan to wire one.
- Sentry / Logflare / Axiom (error and security-event shipping). None wired; the in-process StderrSecurityEventSink described in the security runbook is the closest existing path.
How we notify of changes
For an existing user account, a material change to this list (a new processor, a meaningful scope change, or a removal) is announced in the next available newsletter and recorded in the public changelog. The page itself is git-versioned; the commit history is the canonical timeline.
Standard Contractual Clauses
For every US-located sub-processor that handles EU personal data we rely on the European Commission’s Standard Contractual Clauses (SCCs) as the transfer mechanism. Transfer Impact Assessments per processor are still pending. That’s a counsel-driven workstream that will open alongside the broader legal engagement.