Sub-Processors
Wonderthrough uses the following third-party services (“sub-processors”) to provide, maintain, and improve our service. Each sub-processor processes data on Wonderthrough’s behalf under contractual data protection obligations.
If you have an executed Data Processing Agreement with Wonderthrough, we will notify you at least 30 days before adding or replacing a sub-processor. You may object within that window per the terms of the DPA.
For details on what data each sub-processor receives and how it’s handled, see our Privacy Policy.
Current sub-processors
| Sub-processor | Purpose | Data processed | Region |
|---|---|---|---|
| Stripe | Payment processing, subscription management, Customer Portal | Email, tokenized payment method, subscription state, invoice history | United States |
| Supabase | Authentication, database, edge functions, file storage | Account data, project metadata, usage logs, cloud-synced content (if enabled), encrypted BYO API keys (if enabled or on web), AI tool routing preferences | United States (AWS us-east-1) |
| Anthropic (Claude) | AI provider — primary model for text analysis pipelines | Manuscript content and pipeline instructions (in-transit only; not stored by Anthropic under current API terms) | United States |
| OpenAI | AI provider — secondary text models and DALL-E image generation | Manuscript content, image generation prompts (in-transit only; not stored by OpenAI under current API terms) | United States |
| AI provider (Gemini, optional) and Google OAuth sign-in | Manuscript content for Gemini pipelines (in-transit only); email and profile for OAuth | United States | |
| PostHog | Product analytics and feature flags (app + marketing site) | Event metadata only — no manuscript content, entity names, or creative data; marketing-site analytics cookies are consent-gated in the EU/EEA/UK/CH | United States (PostHog Cloud) |
| Sentry | Error tracking and monitoring | Error messages, stack traces, platform tags — no manuscript content | United States (Sentry Cloud) |
| Vercel | Marketing site hosting and CDN | Client IP addresses, request headers (standard web-hosting logs) | United States + global CDN |
| Craft | Feedback collection backend | Feedback title, description, auto-context metadata, optional screenshots | United States (pending confirmation) |
AI provider training opt-out
None of the AI providers listed above use Wonderthrough users’ API-submitted content to train their models under their current commercial API terms. Wonderthrough has confirmed this with each provider. If this changes, we will update this page and notify affected users.
Changes to this list
This list is effective as of the date shown above. When we add, replace, or remove a sub-processor, this page is updated and customers with an executed DPA are notified per the 30-day notice obligation in the DPA.
Last updated: April 11, 2026