Subprocessors

This list covers processing both for our own purposes (privacy notice) and on our customers’ behalf (Data Processing Addendum). We update this page at least 30 days before adding a subprocessor and email paying customers.

Provider	Purpose	Data	Location	When	Transfer safeguard
Cloudflare, Inc.	Hosting, database, file and backup storage, security; the bot check on our forms (Turnstile); the real browser used by audits and the simulator; cookieless usage counting (Workers Analytics Engine) and cookieless site analytics (Web Analytics)	Everything the service stores; pages and screenshots of the sites we test; connection data during a visit (IP address, briefly, for security)	USA; Cloudflare’s global network	Always	Turkish law (Law No. 6698, art. 9): standard contract announced by the Personal Data Protection Board · GDPR: EU-US Data Privacy Framework where the provider is certified, otherwise EU Standard Contractual Clauses
Resend	Sending service emails (reports, confirmations, invitations, password resets, subscription notices) and the newsletter to people who opted in	Email address, name (if given), email content, delivery records	USA; sending from the EU region (Ireland)	Always	Turkish law (Law No. 6698, art. 9): standard contract announced by the Personal Data Protection Board · GDPR: EU-US Data Privacy Framework where the provider is certified, otherwise EU Standard Contractual Clauses
Stripe, Inc. and its affiliates	Card payments, subscriptions, refunds and fraud prevention (for some processing Stripe acts as an independent controller)	Email, name, billing details, card details (entered directly with Stripe, never reaching Specoria), payment records	USA, Ireland	When you pay	Turkish law (Law No. 6698, art. 9): standard contract announced by the Personal Data Protection Board · GDPR: EU-US Data Privacy Framework where the provider is certified, otherwise EU Standard Contractual Clauses
OpenRouter, Inc.	Access to AI models for the simulator, visibility measurement, audits and the free test’s small call. Every request carries data_collection: deny, so OpenRouter routes it only to providers that, under the provider policies it lists, don’t collect prompts or train on them	Public page content and screenshots, measurement questions, the simulation task you write; never your name, email or account details	USA	When a measurement runs	Turkish law (Law No. 6698, art. 9): standard contract announced by the Personal Data Protection Board · GDPR: EU-US Data Privacy Framework where the provider is certified, otherwise EU Standard Contractual Clauses
AI model providers (Anthropic, OpenAI, Google, Perplexity)	Run the models: through OpenRouter or, when enabled experimentally for the simulator, through their own APIs (the provider’s API terms then apply)	Same as OpenRouter	USA	When a measurement runs	Turkish law (Law No. 6698, art. 9): standard contract announced by the Personal Data Protection Board · GDPR: EU-US Data Privacy Framework where the provider is certified, otherwise EU Standard Contractual Clauses

Services you connect (not subprocessors)

The services below are your own accounts; you set up the connection and can remove it at any time. Data is exchanged only on your instructions and with your approval, and the service’s own terms apply.

Google Analytics 4 and Search Console (Google LLC): If you set up the connection, aggregate numbers are read with read-only access.
Shopify and WooCommerce: If you connect your store, product data is read; a suggested change is written only when you approve it, and can be undone.
Trendyol and Hepsiburada: If you enter your seller API key, your listings are only read.
Slack and Microsoft Teams: If you add a notification address, project notifications (scores, tasks) are sent to the channel you choose.

Payments are taken through Stripe only. We don’t sell data, and your data is not used to train AI models. Questions: contact@specoria.com