Appearance
Subprocessor list
Adsidian uses the following subprocessors to deliver the platform and Prism. We will update this page when the list changes; direct questions to privacy@adsidian.ai.
Last updated: October 5, 2026
The list has two parts. Infrastructure and service subprocessors are vendors Adsidian chooses and engages to run the service. Platforms you connect receive data only because you (or your agency) connected them and instructed Adsidian to send it; they act under your own agreement with them.
The "Prism data" column shows whether a service touches Prism tracking data (events, hashed identifiers, leads, orders). "Yes" means it can; "No" means it is used only for other parts of the platform.
Infrastructure and service subprocessors
| Subprocessor | Purpose | Data | Prism data | Location |
|---|---|---|---|---|
| Supabase | Database & authentication | All platform data, incl. CRM contacts and Prism events | Yes | United States |
| Cloudflare | Hosting, CDN, Prism edge network (Workers/KV), custom hostnames and DNS for your tracking subdomain, Turnstile bot checks on Adsidian's own forms | Prism event traffic, cached identity hashes, DNS queries for your tracking domain | Yes | Global edge (US-controlled) |
| Fly.io | API hosting | Data in transit through the API, including Prism data shown in the dashboard or read by the AI assistant | Yes | United States |
| Stripe | Payments and billing | Billing details | No | United States |
| Resend | Transactional email, and lead notification email | Account and system email; lead contact details sent to your configured inbox | Yes | United States |
| Twilio | SMS and voice for Managed accounts: lead alerts, weekly summaries, phone verification, tracking numbers | Phone numbers and alert text, which can include lead details | Yes, for Managed accounts | United States |
| Apple (APNs) and Google (FCM) | Push notifications to Adsidian CRM mobile apps | Notification text and device tokens | No | United States |
| Dropbox Sign | E-signature of Adsidian agreements | Signer name, email and signed documents | No | United States |
| Cal.com | Demo booking | Prospect name, email and booking details | No | United States |
AI and creative providers
| Subprocessor | Purpose | Data | Prism data | Location |
|---|---|---|---|---|
| Anthropic | AI assistant and campaign strategy | Prompts and conversation context (may include CRM contact details and Prism diagnostics surfaced by tools) | Yes, when the assistant is used on Prism data | United States |
| OpenRouter | AI model routing for the legacy agent path and some bulk/fast-tier tasks. Requests are forwarded to the model vendor chosen for the task (for example Anthropic or DeepSeek) | Prompts and campaign context | No | United States |
| DeepSeek | Bulk and fast-tier AI tasks, called directly or through OpenRouter | Prompts and campaign context | No | Provider-operated. Not guaranteed to be United States; see note below |
| Groq and OpenAI | Voice dictation transcription | Dictation audio (not stored) | No | United States |
| Google (Gemini image generation), Runway, Higgsfield, fal.ai | Creative generation | Creative prompts and generated assets (no end-user personal data) | No | United States |
| SerpApi | Ad-library research (Google Ads Transparency Center lookups) | Search terms and advertiser names | No | United States |
DeepSeek processing location
DeepSeek's own API is operated by the provider outside the United States, and the serving location of a request sent through OpenRouter depends on the host OpenRouter selects. Adsidian uses DeepSeek only for bulk and fast-tier AI tasks, with an Anthropic fallback. If your agreement or jurisdiction restricts that routing, contact privacy@adsidian.ai.
Platforms you connect (data sent at your direction)
These receive data only when a customer connects them, acting on the customer's instructions.
Ad platforms
| Platform | Purpose | Data | Prism data |
|---|---|---|---|
| Meta | Campaign management, Conversions API delivery, lead form ingestion | Campaign data; conversion events with hashed identifiers, subject to visitor consent | Yes |
| Google (Google Ads) | Campaign management and conversion delivery | Campaign data; conversions (gclid, hashed email/phone), subject to visitor consent | Yes |
| Campaign management; Conversions API delivery where enabled for the client | Campaign data; conversion events with hashed identifiers, subject to visitor consent | Yes | |
| Campaign management and Conversions API delivery | Campaign data; conversion events with hashed identifiers, subject to visitor consent | Yes | |
| ChatGPT Ads (OpenAI) | Campaign management and server-side conversions | Campaign data; conversion events with hashed identifiers, subject to visitor consent | Yes |
Visitors who deny ad consent, or whose browser sends a Global Privacy Control signal, are never forwarded to these platforms. See Consent integration.
Commerce and mobile platforms
| Platform | Purpose | Data | Prism data |
|---|---|---|---|
| Shopify | Order and abandoned-checkout webhooks, product catalog sync | Orders, checkouts and product data for the connected store | Yes |
| WooCommerce, BigCommerce, Wix | Order and cart data for connected stores | Orders and carts for the connected store | Yes |
| Google Play, Apple App Store | In-app purchase verification for Prism mobile apps | Purchase tokens and receipts | Yes |
CRMs
| Platform | Purpose | Data | Prism data |
|---|---|---|---|
| GoHighLevel | CRM sync | Contact records (bidirectional, the customer's own CRM); leads captured by Prism can be forwarded to it | Yes |
| HubSpot | CRM sync | Contact records (the customer's own CRM) | No |
International transfers
Data is processed in the United States. For personal data originating in the EEA, UK, or Switzerland, we rely on each subprocessor's Standard Contractual Clauses and/or EU–US Data Privacy Framework participation. See the Data Processing Agreement.