Sub-processors
Last updated: May 26, 2026
Whirl uses the sub-processors below to provide, secure, monitor, and improve the service. The exact providers used for a customer may depend on the integrations, AI models, regions, and browser tools enabled for that customer.
We do not allow sub-processors to use customer content to train generalized AI models unless a customer has expressly instructed or opted into that use.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Clerk | Authentication, user management, organization membership | Account identifiers, email addresses, names, authentication metadata | United States |
| Convex | Backend database, serverless functions, file storage | Application data, integration metadata, messages, tasks, attachments, usage records | United States |
| Vercel | Application hosting and edge infrastructure | Requests, technical logs, limited application metadata | Global infrastructure |
| PostHog | Cookieless website analytics and product analytics | Public pageviews, campaign parameters, product event metadata | United States or EU, depending on project configuration |
| Resend | Transactional email delivery | Email addresses, message metadata, transactional email content | United States |
| Anthropic | AI model inference | Prompts, tool context, outputs needed to provide AI features | United States or configured provider regions |
| OpenAI | AI model inference | Prompts, tool context, outputs needed to provide AI features | United States or configured provider regions |
| Google AI / Google Cloud | AI model inference and related cloud processing | Prompts, tool context, outputs needed to provide AI features | Configured Google Cloud/model regions |
| OpenRouter | AI model routing and model provider access | AI request metadata, prompts, outputs as needed to route requests | United States or provider infrastructure |
| Vercel AI Gateway | AI request routing, provider access, observability, cost reporting | AI request metadata, prompts, outputs as needed to route requests | Global infrastructure |
| Browser Use | Managed browser automation | Browser run instructions, browser state, screenshots, recordings, extracted outputs where enabled | United States or provider infrastructure |
Changes
We will update this page before appointing a new sub-processor that materially processes customer content. Customers may contact hello@whirl.sh with questions or objections.
Transfers
Some sub-processors process data outside the UK or EEA. Where required, Whirl relies on the relevant data processing terms, adequacy regulations, Standard Contractual Clauses, the UK Addendum, or the UK International Data Transfer Agreement.