Subprocessors
Last updated: 2026-05-08
1. About this list
The third parties below process personal data on our behalf when you use Meridian. We have written agreements (Data Processing Addenda or equivalent) with each of them; copies are available on request.
This list is part of our Privacy Policy; reading them together gives the full picture of where your data flows.
2. Current subprocessors
Supabase Inc.
US / SG regionPurpose: Authentication, user management, PostgreSQL database, file storage (bug-report screenshots).
Data categories: Account info, project data, bug reports, session tokens.
Vercel Inc.
US / globalPurpose: Hosting, edge runtime, deployment, Vercel Analytics.
Data categories: Server logs, analytics events.
Anthropic PBC
USPurpose: Primary AI vision provider for dashboard assessment.
Data categories: Uploaded screenshots, prompt context (project name, business question, audience, success criteria).
OpenAI OpCo, LLC
USPurpose: Alternative AI vision provider, available on selection.
Data categories: Uploaded screenshots, prompt context.
Google LLC
US / globalPurpose: Alternative AI vision provider (Gemini), available on selection.
Data categories: Uploaded screenshots, prompt context.
Stripe Payments Singapore Pte. Ltd. and affiliates
SG / US / globalPurpose: Payment processing, subscription management, customer portal.
Data categories: Name, email, billing address, card data (Stripe-hosted; never reaches our servers), subscription metadata.
Stripe Payments Singapore Pte. Ltd. and affiliates privacy notice →
Resend Inc.
USPurpose: Transactional email (account confirmation, password reset, billing notices).
Data categories: Email address, message body.
Upstash Inc.
US / SG regionPurpose: Redis for API rate limiting and short-lived caching.
Data categories: IP address, rate-limit identifier, cache keys.
GitHub, Inc.
US / globalPurpose: Engineering issue tracking — bug reports submitted via the in-app widget are converted into private GitHub Issues.
Data categories: Bug report content, screenshot URL, browser user-agent, timestamp, Issue author.
3. Changes to this list
We'll update this page when we add a new subprocessor or remove an existing one. For material changes that affect how your data is processed, we'll give at least 30 days' notice via email or in-app notification before the change takes effect, so you can object or terminate if you wish.
4. Verification
If you need a signed copy of any subprocessor's DPA, evidence of an SCC / UK IDTA in place, or an attestation for your own compliance audit, email hello@insights-2.com.