Subprocessors
Last updated: July 2026
Brighter uses a small number of vendors to run the Service. This page lists every one of them that may process personal data on our behalf, what they do, and where they are located. It exists so that a customer can review our supply chain before trusting us with their data, and it forms part of our Data Processing Agreement.
We will announce changes to this list on this page before a new subprocessor starts processing data.
Controller: Daria Guseva Brighter Analytics, Czerniakowska street 174, Warsaw 00-440, Poland, VAT NIP 7011303570.
Core infrastructure
Railway - Application hosting, databases, object storage (EU (Amsterdam))
Keycloak (self-hosted on Railway) - Authentication and account records (EU)
Backblaze B2 - Encrypted off-site backups (Verify region)
Processing your content
Google (Gemini API) - Generates answers from your questions and uploaded files (See note below)
Anthropic, PBC - AI provider for parts of the Service (US)
Extraction service (self-operated VM) - Opens `.pbix` files and extracts the model, DAX and layout (Verify region)
On model training. We do not use your files or personal data to train AI models, and we require the same of our AI providers. On paid API tiers Google does not use prompts or uploaded files to improve its products, and for customers established in the EEA, Switzerland and the UK those same terms apply to the free tier as well.
Payments, email and analytics
Stripe, Inc. - Payment processing and subscription billing (IE / US)
Resend - Transactional email (receipts, verification, notifications) (US)
PostHog - Product analytics - only after you accept analytics cookies (US, moving to EU)
Meta Platforms - Advertising measurement - only after you accept advertising cookies (US)
Reddit, Inc. - Advertising measurement - only after you accept advertising cookies (US)
Google (Tag Manager) - Tag management - only after you accept cookies (US)
Analytics and advertising vendors receive nothing at all unless you accept the corresponding cookies. Reject, and no request is made to them.
Website
Vercel - Hosting for the marketing site and the quiz (EU edge)
Tilda - Legacy landing page builder - being retired (DE / LU, support via KZ)
Transfers outside the EEA
Where a subprocessor is outside the European Economic Area, the transfer relies on an adequacy decision where one exists, and otherwise on the European Commission's Standard Contractual Clauses together with the technical measures described in our Privacy Policy.
We do not use any subprocessor located in a country subject to sanctions or lacking an adequate legal framework for such transfers. Analytics previously ran through a provider hosted in Russia; that has been removed.
Questions
Write to info@brighter.rocks. Customers with a signed Data Processing Agreement can request advance notice of changes to this list.
Brighter uses a small number of vendors to run the Service. This page lists every one of them that may process personal data on our behalf, what they do, and where they are located. It exists so that a customer can review our supply chain before trusting us with their data, and it forms part of our Data Processing Agreement.
We will announce changes to this list on this page before a new subprocessor starts processing data.
Controller: Daria Guseva Brighter Analytics, Czerniakowska street 174, Warsaw 00-440, Poland, VAT NIP 7011303570.
Core infrastructure
Railway - Application hosting, databases, object storage (EU (Amsterdam))
Keycloak (self-hosted on Railway) - Authentication and account records (EU)
Backblaze B2 - Encrypted off-site backups (Verify region)
Processing your content
Google (Gemini API) - Generates answers from your questions and uploaded files (See note below)
Anthropic, PBC - AI provider for parts of the Service (US)
Extraction service (self-operated VM) - Opens `.pbix` files and extracts the model, DAX and layout (Verify region)
On model training. We do not use your files or personal data to train AI models, and we require the same of our AI providers. On paid API tiers Google does not use prompts or uploaded files to improve its products, and for customers established in the EEA, Switzerland and the UK those same terms apply to the free tier as well.
Payments, email and analytics
Stripe, Inc. - Payment processing and subscription billing (IE / US)
Resend - Transactional email (receipts, verification, notifications) (US)
PostHog - Product analytics - only after you accept analytics cookies (US, moving to EU)
Meta Platforms - Advertising measurement - only after you accept advertising cookies (US)
Reddit, Inc. - Advertising measurement - only after you accept advertising cookies (US)
Google (Tag Manager) - Tag management - only after you accept cookies (US)
Analytics and advertising vendors receive nothing at all unless you accept the corresponding cookies. Reject, and no request is made to them.
Website
Vercel - Hosting for the marketing site and the quiz (EU edge)
Tilda - Legacy landing page builder - being retired (DE / LU, support via KZ)
Transfers outside the EEA
Where a subprocessor is outside the European Economic Area, the transfer relies on an adequacy decision where one exists, and otherwise on the European Commission's Standard Contractual Clauses together with the technical measures described in our Privacy Policy.
We do not use any subprocessor located in a country subject to sanctions or lacking an adequate legal framework for such transfers. Analytics previously ran through a provider hosted in Russia; that has been removed.
Questions
Write to info@brighter.rocks. Customers with a signed Data Processing Agreement can request advance notice of changes to this list.