Sub-processors
Under GDPR Art. 28 we maintain a list of every third-party processor that touches data on Grail Atlas’s behalf. This page is the canonical record. It’s updated in the same change-set as any processor change — adding, removing, or scope-shifting — and the git history is the canonical timeline.
Active today (7)
Vercel, Supabase, and Upstash are involved on every page load. Cloudflare handles DNS for every domain lookup. Resend handles outbound email. Voyage AI receives query text when you use natural language search. Anthropic receives editorial prompts from the blog-draft cron job (not from visitor traffic).
- VercelACTIVE
Role. Application hosting, edge middleware, CDN, + cookieless Web Analytics and Speed Insights (gated by visitor consent).
Data received. Request metadata (IP, user-agent, URL, response time), short-term access logs. With analytics consent: cookieless aggregate page-view count + Core Web Vitals (no persistent identifier, IP hashed + discarded after 24 hours per Vercel).
- SupabaseACTIVE
Role. Primary database (Postgres) and authentication for any account or signup data.
Data received. For anonymous visitors: nothing. For signed-up visitors: account email, hashed password, saved searches, Grail List entries, newsletter subscriptions with proof-of-consent, and the audit-log rows that record privacy operations.
- UpstashACTIVE
Role. Redis-backed rate limiting for the mutation endpoints (newsletter signup, /request form, /privacy/request when it lands).
Data received. Rate-limit counters keyed by hashed IP. No personal identifiers.
- CloudflareACTIVE
Role. Domain registrar and DNS provider for grailatlas.com.
Data received. DNS queries for grailatlas.com: public network metadata that every DNS resolver between you and the site already sees. No site-level personal data flows through Cloudflare today.
- ResendACTIVE
Role. Outbound transactional email for account confirmation, privacy request confirmation, deletion receipts, blog digest notifications, and admin alerts.
Data received. Recipient email address and confirmation-link content. No site browsing or saved-search history.
- Voyage AIACTIVE
Role. Embedding model API used for natural language search. Query text submitted by users is sent to Voyage AI to generate a search embedding vector. No account or identity data is included.
Data received. User-submitted search query text. No account identifier, email, or saved-list data.
- AnthropicACTIVE
Role. AI model API used at authoring time (blog draft generation via weekly cron job). No visitor data is sent to Anthropic; only editorial prompts constructed from public catalog data.
Data received. Editorial prompts containing public catalog data (watch names, descriptions). No visitor email, search history, or account data.
Configured but not transmitting (2)
Wired into the codebase or env but currently inert. Listed so the picture is honest: these names appear inpackage.json or .env.example but no line of executing code sends them data today. Each one moves to ACTIVE the day the wiring lands, with the privacy policy + ROPA updated in the same commit.
- Cloudflare R2CONFIGURED · NOT TRANSMITTING
Role. Object storage for reference photos (planned). Today, photos are served from the Vercel-hosted /public directory; R2 is documented for the eventual migration.
Data received. Photo binary fetches (no per-visitor identifier).
- RailwayCONFIGURED · NOT TRANSMITTING
Role. Background worker hosting for any reassessment / email-digest / ingest jobs (planned). No worker is currently deployed; everything is SSR on Vercel.
Data received. Service-role access to Supabase when active. No direct user identifiers stored at Railway.
Future (2)
Planned for known features. Listed so the road-map is visible rather than emerging as a surprise.
- DeepLFUTURE
Role. Machine translation of community signals authored in non-English languages. Credentials provisioned; off by default.
Data received. Short text excerpts authored by community contributors.
- MapboxFUTURE
Role. Map tiles for the Atlas geographic UI (planned).
Data received. Tile-fetch requests with approximate viewport coordinates and visitor IP at the time of the request when active.
Notable absences
Things the audience may reasonably wonder about that are not currently in use:
- OpenAI or any other LLM API at runtime. Anthropic is listed above as an active sub-processor but only for authoring-time blog drafts; no inference runs on visitor traffic.
- Google Analytics, Plausible, Fathom, or any third-party web-analytics provider beyond the Vercel-native cookieless layer. None wired and none planned.
- Advertising networks. None wired and no current plan to wire one.
- eBay Partner Network. Outbound affiliate clicks are not yet attributed; the integration is on the post-launch roadmap and will appear here when it ships.
- Sentry / Logflare / Axiom (error and security-event shipping). None wired; the in-process StderrSecurityEventSink described in the security runbook is the closest existing path.
How we notify of changes
For an existing user account, a material change to this list (a new processor, a meaningful scope change, or a removal) is announced in the next available newsletter and recorded in the public changelog. The page itself is git-versioned; the commit history is the canonical timeline.
Standard Contractual Clauses
For every US-located sub-processor that handles EU personal data we rely on the European Commission’s Standard Contractual Clauses (SCCs) as the transfer mechanism. Transfer Impact Assessments per processor are still pending — that’s a counsel-driven workstream that will open alongside the broader legal engagement.