Legal
Subprocessors
Third parties engaged by the sole trader trading as VibePlan (also trading as ProcureLex and CommerceSans) to process personal data when providing VibePlan.
Last updated: 27 July 2026
This list covers platformsubprocessors. Tools you connect in Connections (for example Google Calendar or Slack) process data under your instructions and those providers' terms; they are not listed as VibePlan platform subprocessors here. See the Privacy Policy for the full picture.
Platform subprocessors
| Name | Purpose | Location | Typical data |
|---|---|---|---|
| Supabase | Authentication, PostgreSQL database, storage, and Row Level Security | EU (project region eu-west-2) | Account identity, workspace content, logs metadata |
| Vercel | Application hosting, edge/serverless compute, and deploy infrastructure | Global edge/network; serverless/primary regions per Vercel project configuration | Request logs, account session cookies, application telemetry |
| OpenRouter (LLM routing) | Primary platform LLM inference for blueprint generation and related AI features | OpenRouter (United States); upstream model provider locations vary by route | Prompt and completion content derived from workspace inputs |
| OpenAI | Labeled availability failover (e.g. gpt-5.4-mini) and optional embeddings paths | Per OpenAI data processing terms | Prompt and completion / embedding inputs when routed |
| Inngest | Durable workflow orchestration for generation and agent steps | United States (per Inngest security documentation) | Workflow payloads (IDs, step metadata; minimise free-text PII) |
| Resend | Transactional and support notification email | United States (per Resend GDPR documentation) | Email addresses, message content for notifications |
| Stripe | Subscription billing and payment processing | Stripe Payments Europe / global Stripe infrastructure per Stripe DPA | Billing contact, payment method tokens, invoice metadata |
| PostHog | Product analytics (funnels, activation) | EU Cloud when configured; host confirmation tracked in CIP-L-030 | Pseudonymous usage events, account/workspace identifiers as configured |
Updates
We will update this page when we add or replace a platform subprocessor. Material changes may also be reflected in the Data Processing Agreement annex for B2B customers.
Location notes reflect the best available vendor documentation and deployment records. Some providers use global infrastructure or upstream subprocessors; those entries are deliberately caveated until counsel verifies the relevant account terms and dashboards.
LLM data flows
Blueprint generation and related AI features send relevant workspace context (Discovery answers, blueprint excerpts, prompts) to the configured LLM route (primarily OpenRouter; labeled OpenAI mini failover in some resilience cases). Operator+ workspaces may use bring-your-own-key providers, which process data under the customer's provider relationship. We do not claim to train foundation models on your business content.
Draft for commercial launch. Legal review and sign-off are still required before treating these pages as final counsel-approved terms.