Answer
Every outside company that receives brand or team data from production, what it gets and where, so the privacy policy, the DPA and the code all list the same vendors.
Today
Vendors that receive brand or team data
| Vendor | What for | What it receives | Where | Source |
|---|---|---|---|---|
| Google Cloud | Hosting: Cloud Run, Cloud SQL, Storage, Secret Manager, load balancer, Cloud Armor, Monitoring | Everything production holds | asia-south1, Mumbai | brew/docs/production.md:9-15 |
| Google Vertex AI | Gemini writes Plays, cards, drafts and briefs and draws images | The brand's read, facts, team notes, connected numbers, photos | Project squareup-492617; model region to confirm | brew/tools/prod-env.sh:9 brew/gemini-client.js:2, 11 |
| OpenAI | Voice transcription; image edits and images; speech | Voice notes, photos, prompts | US | brew/server.js:1038 brew/media.js:27-35 |
| Higgsfield | Image and video models in the Studio, when its keys exist | Prompts, photos | To confirm | brew/jam2/engines.js:7, 60 brew/tools/prod-env.sh:12 |
| Sloosh | Paid finals over its MCP server, from our own workspace | The brief, product photos, references, a viral clip as a motion reference | To confirm | brew/legal-pages.js:29 memory brew-sloosh-finals memory brew-viral-remakes |
| Resend | Team email from hello@send.joinsquareup.com | Team names and emails, brand names, brief text | To confirm | brew/auth.js:174-177 |
| treg | Public data: search, social, ads, reviews, marketplaces | Brand and rival names, domains, search words | To confirm | brew/tools/prod-env.sh:9-10 memory treg-catalog-for-brew |
| Apify | Public marketplace and quick commerce pages where treg is weak | Product names, brand names | To confirm | brew/tools/prod-env.sh:11 memory brew-apify-watch |
| PullPush | Reddit thread counts | Thread ids | To confirm | brew/community-gate.js:112-121 |
| Cloudflare | DNS for feed.joinsquareup.com | Visitor requests only if the record is proxied; to confirm | Global | memory brew-prod-backend |
Keys mounted but not the main path
- Anthropic: the key is mounted on production while
AI_PROVIDER=gemini; whether any path still calls it needs a check. brew/tools/prod-env.sh:9-10 - Google PageSpeed and the YouTube Data API get public addresses only. brew/tools/prod-env.sh:10
Not subprocessors: the brand's own tools
Shopify, Meta, Google Ads, Google Analytics, Klaviyo, Judge.me and Slack are accounts the brand connects. We read from them, read only; Slack is the one we post to, in the channel the brand picked. brew/docs/connectors-approvals.md:6-15
What the privacy page lists today
Google Cloud, data providers, Sloosh and Resend; OpenAI, Higgsfield and the named data vendors are missing. brew/legal-pages.js:29
Tomorrow
| Item | Version | Tag |
|---|---|---|
| This table published as a public subprocessors page, linked from the policy | v1 | New |
| Every vendor's region and data terms confirmed and filled in | v1 | Changes |
| Remove the Anthropic key from production if unused | v1 | Goes, proposed |
| A check in the clean gate that fails a promote when a new outside host appears in code without a row here | v2 | New, proposed |
| Posting vendors, if v2 posts through anything but the brand's own tools | v2 | Changes |
How we do it
- Before any code calls a new outside service with brand or team data, add its row here and to the privacy policy in the same change.
- Find every outside host the code calls:
git -C /Users/param/Documents/ChatGPT/brew grep -ohE "https://[a-z0-9.-]+\.(com|ai|io|net|to|app|dev)" origin/main -- '*.js' ':!test' ':!skills' | sort | uniq -c | sort -rn
- List the secrets production mounts; each paid key is a vendor:
git -C /Users/param/Documents/ChatGPT/brew show origin/main:tools/prod-env.sh | sed -n '10,12p' | tr ',' '\n'
- Email partners 14 days before a new vendor goes live, once the DPA is signed.
Numbers
| Metric | Definition | Where measured | Status |
|---|---|---|---|
| Vendors with brand data | Rows in the first table | This page | 10 on 26 Oct |
| Vendors missing from the policy | Rows not named on /privacy |
This page against legal-pages.js |
6 on 26 Oct |
| Regions to confirm | Rows whose region says to confirm | This page | 7 on 26 Oct |
Open
- Which region does Vertex run Gemini in? Proposal: pin it to asia-south1 where the model exists there, and say so on the page.
- Is Higgsfield live on production? Proposal: Param confirms whether
HF_API_KEY_SECRETexists; if not, drop the row until it does. - Is the Cloudflare record proxied? Proposal: keep it DNS only, so Cloudflare sees no traffic, and confirm in the dashboard.
- Do we publish vendor names on a public page? Proposal: yes, a short list with purpose and country, the way most software companies do.