Legal
Sub-processors & Data Processing Addendum
Last updated: July 22, 2026
Who we are.PingMyBrand is operated by Aylan Technologies LLC. This page lists every third-party vendor ("sub-processor") we use that processes personal data on our behalf, as required by GDPR Article 28(2)'s transparency obligation. It is generated from — and stays consistent with — the same processing registry our internal GDPR Article 30 Record of Processing Activities uses (lib/gdprRecordOfProcessing.ts), never a second, hand-maintained list that could drift out of sync.
Customer-configured integrations are not sub-processors. If you connect your own Slack workspace or a webhook endpoint, that is YOUR configured destination for YOUR own data — we deliver to it, we don't process on your behalf as a vendor the way the vendors below do.
| Sub-processor | Purpose | Data shared | Region |
|---|---|---|---|
| Stripe, Inc. | Payment processing, subscription billing, and (where enabled) tax calculation/collection. | Billing/payment details, email, subscription plan and status. PingMyBrand never sees or stores card numbers directly. | United States (Stripe's own global processing infrastructure). |
| Resend | Transactional email delivery — report links, account notifications, and marketing emails you opted into. | Email address, message content of the email sent to you. | United States. |
| OVH | Application hosting — the VPS that runs PingMyBrand's web app, API, and database. | All data this codebase stores passes through this server (see /privacy for the full list). | Not independently re-confirmed by this seat as of this update — OVH offers both EU and North American regions; the account/region is owner-controlled infrastructure this seat cannot directly inspect. Tracked as an open item, not fabricated. |
| OpenAI | AI-visibility scanning — we send your brand name, domain, and generated buyer questions to ChatGPT and read back its answer to measure whether it mentions/recommends you. | Brand/domain/question text only — never your account email, password, or billing details. | United States. |
| Anthropic | AI-visibility scanning against Claude — same scope as OpenAI above. | Brand/domain/question text only. | United States. |
| Google (Gemini) | AI-visibility scanning against Gemini — same scope as OpenAI above. | Brand/domain/question text only. | United States. |
| Perplexity | AI-visibility scanning against Perplexity — same scope as OpenAI above. | Brand/domain/question text only. | United States. |
| xAI (Grok) | AI-visibility scanning against Grok — same scope as OpenAI above. | Brand/domain/question text only. | United States. |
No certifications claimed. PingMyBrand does not hold SOC 2, ISO 27001, or any other formal security certification today. We will not claim one until it is real — see our security page for our actual, current security posture.
Data Processing Addendum (DPA). If your organization requires a signed Data Processing Addendum under GDPR Article 28 before you can use PingMyBrand (typical for EU/UK business customers), see our DPA page for how to request one.
Changes.If we add or remove a sub-processor, we'll update this page. Material additions that change how your data is processed will also be reflected in our privacy policy.