Legal · Subprocessors
Subprocessors
When a business uses Pilgud Agent, we process its data – and its customers' enquiries – as its processor. These are the services we use to do that. We tell our clients before we add or replace one.
Every client
| Service | What it does in Pilgud Agent | Data | Where |
|---|---|---|---|
| Supabase | Database, login and file storage | All workspace data: profile, photos, videos, ads, enquiries | EU (Frankfurt) |
| Vercel | Hosting of the app and this site | Data passing through requests; request logs | EU (Frankfurt) functions; global network |
| Anthropic | AI models for the chat, ad copy, review and reading websites and photos | Business profile, ad text, chat, photos | United States |
| Google (Gemini) | Making pictures for ads and checking the words on them | Picture prompts, the business's logo and product photos | Global |
| Google Cloud (Vertex AI, EU) | Watching videos the owner films; checking how AI search sees the business | Video frames and sound, business name and website | EU |
| OpenAI | Making the main ad pictures (pictures without text) from the ad brief | The ad brief text and the generated pictures – no client photos | United States – OpenAI API terms and data processing addendum; API data is not used to train its models; zero data retention available on request |
| Higgsfield | Making images and videos for ads with specialised models (fallback) | Picture prompts and reference photos | United States – under its published terms, no separate data processing agreement; it may use uploaded material to train its models |
| Resend | Sending e-mails from the app (new enquiries, weekly notes) | E-mail addresses; enquiry details in the e-mail | United States |
| Meta Platforms Ireland | Building and running Facebook and Instagram campaigns; telling Meta which ads brought customers | Ads and campaign settings; click identifiers, and hashed contact details only when the business has a lawful basis | EU / United States |
| TypeSafe | A fast decision model in the agent's daily checks | Ad text only – no contact details | United States |
| Firecrawl | Reading the business's public website | Public website content | United States |
| Google Workspace | Our own mailbox (info@pilgud.com) | Questions and requests sent to us from the app | EU / United States |
Only when switched on for a business
| Service | When | Data | Where |
|---|---|---|---|
| Google Ads | Google campaigns we run for the business | Ads, campaign settings, conversion click identifiers | EU / United States |
| Posting to the business's LinkedIn page | Post text and images | EU / United States | |
| ElevenLabs | Turning speech in the owner's videos into text | Voice in the video | EU / United States |
| Stripe | Paying for the plan | The business's billing details (not its customers' data) | EU / United States |
Transfers outside the EU
Where a service processes data in the United States, it does so under the EU–US Data Privacy Framework and/or the EU standard contractual clauses in its terms.
Changes
We tell our clients by e-mail before we add or replace a subprocessor, and they can object. Questions: info@pilgud.com. How we handle personal data in general: privacy policy.