Legal
Subprocessor list
Last updated: 2026-04-20 · Version 1.0
Placeholder. Pulsus legal team to replace this copy by 2026-05-15. Structure + links are final; body text is provisional.
To run Pulsus we rely on a small set of third-party processors. Each one is bound by a data-processing agreement with us, handles only the category of data listed below, and is required to treat personal data under the same standards we apply ourselves. This page is part of our GDPR Art. 28 and CCPA service-provider disclosure.
We commit to giving at least 14 days' notice before adding or replacing a subprocessor. If you want to be notified directly when that happens, email privacy@pulsus.co and we will add you to the notification list.
| Processor | Purpose | Location | Transfer mechanism | Policy |
|---|---|---|---|---|
| Stripe, Inc. | Payments, subscription billing, tax | United States · Ireland | SCCs + UK IDTA + KVKK Standart Sözleşme | Read |
| Resend | Transactional email delivery | United States | SCCs + UK IDTA | Read |
| Railway | Application + database hosting | United States (Oregon) | SCCs + UK IDTA | Read |
| PostHog | Product analytics + feature flags | United States (EU self-host option available) | SCCs | Read |
| Sentry | Error + performance monitoring | United States | SCCs | Read |
| Anthropic / OpenAI (AI coach provider) | LLM inference for the AI coach — zero-retention contract | United States | SCCs + DPA + zero-retention addendum | Read |
| FAL | On-demand image generation for marketing + share cards | United States | SCCs | Read |
| Vercel | Frontend hosting + edge middleware | Global edge network | SCCs | Read |
| Meta Platforms, Inc. | Ad measurement + CAPI (only when ads consent bucket is on) | United States · Ireland | SCCs | Read |
The processing activities themselves are described in our Privacy Policy. For B2B customers on our Family Plan, the Data Processing Agreement names each subprocessor as a named-subcontractor under Art. 28.