Sparks Sub-processors
Last updated: 11 October 2026
These are the service providers that may process personal data for Sparks: our users' account data (where Sparks is the controller) and the visitor data on our customers' sites (where Sparks is the customer's processor, under our DPA). Each is bound by a contract that limits it to our instructions and requires appropriate security. Where a location or safeguard says "to be named", we'll add it here before the paid launch.
Current list
| Vendor | Purpose | Personal data involved | Location of processing | Transfer safeguard |
|---|---|---|---|---|
| Vercel Inc. | Hosting of bysparks.com and customer sites; serverless functions; cookieless web analytics on bysparks.com | All data passing through the apps (account, site content, form submissions in transit); analytics without cookies | USA (company); function region to be named; global edge network | Vercel's data processing terms; mechanism to be named |
| Vercel AI Gateway (Vercel Inc.) | Routes AI requests to the model providers below | Owner's material and site text in AI requests | USA | As Vercel above |
| OpenAI, L.L.C. (via Vercel AI Gateway) | Writing, fact extraction, photo edits | Owner's material, site text, owner's photos | USA | OpenAI's data processing terms; API terms don't allow training on our data; mechanism to be named |
| Anthropic, PBC (via Vercel AI Gateway) | Checking every sentence against the facts; writing assistance | Owner's material and site text | USA | Anthropic's data processing terms; API terms don't allow training on our data; mechanism to be named |
| Supabase, Inc. | Database, sign-in (authentication), file storage | Account data, site content and media, contact-form messages, newsletter subscribers, login records | bysparks.com: USA (AWS us-west-2, Oregon). Hosted sites and the build system: region to be named | Supabase's data processing terms; mechanism to be named |
| Resend (via Supabase sign-in) | Sending sign-in emails for bysparks.com | Email addresses, sign-in emails, delivery data | USA (company); sending region to be named | Resend's data processing terms; mechanism to be named |
| Amazon Web Services EMEA SARL / Amazon Web Services, Inc. (Amazon SES) | Sending email for sites: contact-form notifications to owners, newsletter confirmations and sends, site notices | Email addresses, names, email content, delivery and bounce data | EU: Sweden, Stockholm (eu-north-1) | Within the EU; AWS's data processing terms cover any access from the US |
| Zoho Corporation (Zoho Mail) | Our business email (support@ and privacy@bysparks.com) | Names, email addresses and whatever people write to us | Data centre to be named | Zoho's data processing terms; mechanism to be named |
| Better Stack | Uptime monitoring and alerts | No customer personal data (checks public URLs and health endpoints; holds only our own alert addresses, such as ops@) | Region to be named | Not applicable (no customer personal data) |
| Paddle.com Market Ltd | Merchant of record for payments (from the paid launch only; not used in the beta) | Buyer name, email, country, payment details, tax data | UK (company) | Paddle acts as a separate controller as reseller; UK adequacy |
Not sub-processors (listed for transparency):
- GitHub, Inc. holds our source code. No customer data is stored there.
- Google (only if you choose "Sign in with Google") is your identity provider, under Google's own terms.
- Gated features not used in the beta: a web search API (not chosen), connectors to other platforms. They'll be added here, with notice, before being switched on.
How we tell you about changes
- We update this page and its date before a new sub-processor starts processing personal data.
- Customers (site owners) get an email about changes. During the beta, we email all account holders at least 10 business days before a new sub-processor handles personal data (as in our DPA). From the paid launch, we give at least 30 days' notice by email.
- Objections: a customer who objects on reasonable data-protection grounds can tell us at privacy@bysparks.com within 30 days of our notice. We'll discuss alternatives; if none works, the customer may end the service and export their data (as in the Common Paper DPA's sub-processor objection mechanism).