Sub-processors

These are the categories of third parties Far & Wide uses to operate the platform. GDPR permits disclosure of recipients by category (Articles 13-14), and we deliberately keep the specific providers confidential to protect commercially sensitive detail of how the platform is built. The full named list — each provider's identity, location and role — is available to customers on request (under NDA for enterprise accounts). We tell every platform customer at least 14 days before adding or replacing a sub-processor, and you may object (see our Data Processing Agreement, section 6).

• Payment processing — subscription and order billing (EU + US; SCCs / DPF). Receives the billing email plus the card brand and last four digits only; never full card numbers.
• Hosting, delivery and log ingestion — serves the website, portal and API routes, and ingests the AI-visibility log-drain signals (EU region + global edge; SCCs / DPF).
• EU database, authentication and file storage — where accounts, brand data, runs, artifacts and visitor-signal tables are held (EU region, Frankfurt; SCCs / DPF for any US-parent access).
• EU audit compute — runs the audit pipeline (EU / EEA: Belgium since September 2026; earlier runs were processed in Finland).
• Transactional email — delivery of sign-in links, password resets and account email (SCCs).
• Customer-relationship management — customer communications, where used (SCCs).
• Website and product analytics — website analytics and EU-hosted product analytics and session recordings. Cookies, clicks and recordings only with your consent; without it, the pages you open are counted without cookies (see section 4 of our Cookie Policy).
• Internal team notification — alerts our founders when someone requests a demo, or buys a plan before saving their account (relays the details given: name, email, company, plan).
• Support chat — answers visitor questions on our website and platform. Uses an AI language-model provider (US; SCCs) and a messaging app to relay the conversation to our founders (outside the EEA; SCCs). Receives the message text and any email address the visitor supplies. Our product analytics counts chat events without linking them to that email.
• AI processing (the models that draft and check) — the models we run to write and check your fixes and content. Where you connect a code repository, this is the only category that reads your page's own source, and that request stays inside the EEA (Sweden, France) on subscriptions held by Vector Labs B.V. under a company agreement; credentials are screened out before it is sent, and a file that is mostly secrets is withheld entirely. Page text and brand facts may be processed in the US (DPF / SCCs). Model training on submitted data is disabled.
• AI answer engines — the platforms we measure your brand against; requests are designed to carry no personal data.
• Data-collection and search-measurement providers — collect public web content and search results; designed to receive no personal data.

These are services you can choose to connect to your account. Each one is your own account with that provider, connected only if you decide to, with the access described below. We keep the access keys encrypted, use them only for what is listed here and never for another customer, and you can disconnect any of them at any time. Nothing is published to your site or in your name until you approve it (on Webflow, see the note in its line). Unlike our sub-processors above, these are named, because they are your own accounts.

• GitHub — connects through our GitHub App on the repositories you choose (accounts connected before 9 September 2026 used a GitHub sign-in, which reaches every repository that person can access; reconnecting through the App narrows it). We can read the repository, push a branch and open a pull request. We copy the repository into our EU compute to build and check a fix, then propose the change you approved as a pull request; you merge it, we never do. Source is read only by the EU AI processing described in Section 2.
• WordPress — connects with an application password for an administrator account, plus our Far & Wide Connector plugin. We can read, create and update posts, pages and media, and add redirects, structured data and language tags. We use it to check a page before a change, publish the change you approved, keep the previous version, and remove what we added if you roll back.
• Webflow — connects through Webflow sign-in (our Webflow app). We can read and update pages, CMS items, redirects and assets, and publish the site. Webflow publishes a whole site at once, so publishing a fix you approved also publishes any other unpublished edits in that site.
• Shopify — connects through our Shopify app installed on your store (stores connected earlier with a pasted access token may also have granted theme access). We can read and update products (SEO fields and image alt text), pages, blog articles, navigation, redirects and metafields, to check, publish what you approved, keep a rollback copy, and remove what we added if you roll back.
• Wix — connects through our Wix app, or a site-owner API key you create. We can read and update pages, SEO settings and blog posts, and write robots.txt and llms.txt, to check, publish what you approved, keep a rollback copy, and remove what we added if you roll back.
• HubSpot — connects through HubSpot sign-in (our HubSpot app), or a private-app token you create. We can read and update CMS pages and blog posts and create and remove redirects, to check, publish what you approved, keep a rollback copy, and remove what we added if you roll back.
• Vercel — connects through Vercel sign-in (our Vercel integration). We can list your projects and domains and create a log drain, which streams server logs (including visitor IP and user-agent) to our EU systems to count AI crawler visits. We limit the drain to the project you pick; if Vercel will not allow that, logs from your other projects on that account arrive too and we discard them on arrival.
• Cloudflare — connects with an API token you create, with Analytics read access. We read your zone's traffic analytics to count visits by AI crawlers.
• Google Search Console, Google Analytics and Gmail — connect through Google sign-in, or for Search Console and Analytics by adding our read-only service account to your property. Search Console and Analytics are read-only; Gmail can only send the outreach messages you approved. Section 7 of our Privacy Policy describes these in full.
• LinkedIn — connects through LinkedIn sign-in. We publish the posts you approved, as you, or as a company page you manage where you choose one.
• Reddit — connects through Reddit sign-in. We publish the posts and comments you approved, as you.
• Script tag (optional) — a one-line script you add to your site so we can check the connection. It changes nothing on your site and sets no cookie; each page view loads it from our hosting, so our EU hosting sees the visitor's IP address and browser, and we do not store them.

• DPF = EU-US Data Privacy Framework (the post-Schrems II adequacy mechanism for certified US recipients).
• SCCs = Standard Contractual Clauses (European Commission Decision 2021/914).
• Named list on request. The identity, location and role of each specific sub-processor is available to customers on request under NDA. Each US recipient has been assessed for surveillance-law risk under our Transfer Impact Assessment.
• AI engines receive no personal data by design: the audit processes public information about companies, brands and products — not personal data about individuals. Query prompts carry only the question text and the brand/company facts you configured, and we operate with model-training on submitted data disabled.
• The one place we keep visitor data (the optional script tag in Section 3 only passes through our hosting and is not stored): if you enable the AI-visibility log drain on your own website, your server logs (including visitor IP and user-agent) stream to our EU hosting and EU database purely to attribute AI-driven crawls and visits to you. For that data you are the controller and we are your processor (see our Data Processing Agreement). Visitor IP addresses are replaced by a scrambled code after 30 days; the rest is kept for the life of your account and deleted when you close it.

Questions about our sub-processors, or to receive the full named list under NDA: hello@farandwide.io.