Subprocessors
Last updated 21 October 2026
These are the services that help us run Kairo Post. Each one gets only the data it needs for its purpose, under a written agreement that limits how it may use that data. Most are based in the United States; see section 9 of our Privacy Policy for how we protect international transfers.
Infrastructure
| Service | Purpose | Data |
|---|---|---|
| Railway | Application hosting: the app, the API, background jobs and job queues | Account, workspace and content data while it is processed and queued; operational logs |
| Supabase | Our main database and private storage for uploaded and generated media and exports | Account, workspace, content, billing and audit records; media files and export archives |
| Sentry | Error and performance monitoring, configured without user details, cookies or request headers | Technical diagnostics, error messages and stack traces |
| Cloudflare | Network delivery and protection in front of our website, app and API, hosting of our website, and PostHog's managed reverse proxy that carries analytics requests | Request details such as IP address, browser details and the address requested; analytics requests on their way to PostHog |
Analytics
| Service | Purpose | Data |
|---|---|---|
| PostHog Inc. | Product analytics, session recording and error tracking for our website and app, and usage events from our servers (such as a sign up, a published post or a payment amount, never content), hosted in PostHog's EU region | Pages visited, clicks, page speed, errors, browser and device type; your random account id and feature usage counts. After you accept cookies, a random visitor identifier and recordings of some visits with form fields and your content hidden. Never what you write |
| Google (Gemini models, through PostHog) | AI review of visit recordings by PostHog's Replay Vision, to find broken pages | Recordings of some visits, only after you accept cookies, with form fields and your content hidden |
Communication and payments
| Service | Purpose | Data |
|---|---|---|
| Resend | Email delivery | Email address and the content of the emails we send you |
| Payment provider (named at checkout) | Hosted checkout, subscriptions and payment processing (independent controller for payment data) | Purchaser identity, payment and subscription status |
| Content moderation service (provided by our payment provider) | Automatic screening of Design Studio requests for sexual or explicit content and deepfakes, before they run | The text of the design request, without your name or email address |
Platforms and sign in
| Service | Purpose | Data |
|---|---|---|
| X Corp. | Publishing and account authorization through the official X API; ad measurement for our own ads on X, only if you accept cookies | Posts, media and actions you authorize for connected accounts; for ad measurement, the X click id and a one way code (SHA-256) of your email address |
| Google, GitHub | Optional sign in, only if you choose it | Name, email address and account identifier |
AI and research, only when you request the work
| Service | Purpose | Data |
|---|---|---|
| OpenRouter | Routing AI requests to the model providers that run them (such as Anthropic, OpenAI and Google): writing, the AI agent, design layout and reading pictures you attach | The prompt and the material you selected for the request |
| Serper, Brave Search | Web search for research features | Search queries, without your account details |
| Podcast Index | Finding podcasts for news feeds you set up | Search terms and podcast addresses, without your account details |
Changes
We update this list before a new subprocessor starts handling personal data. To be told about changes, or to object to one, email support@kairopost.com.