// scope
This list covers subprocessors that process personal data on behalf of empowered.guru, LLC across all our services: the website, the chatbot, internal operations, and client engagements. Specific subprocessors added for a particular SoW are also listed in that SoW. Engagement-specific subprocessors (for example, a dedicated inference provider chosen for a single client) are governed by the SoW.
Last updated: August 16, 2026 · Reviewed quarterly
1. What a subprocessor is
A subprocessor is a third party engaged by empowered.guru, LLC to process personal data on our behalf. We are a processor (or controller) for the data; the subprocessor acts only on our instructions and under a written contract that imposes data-protection terms no less protective than our DPA.
2. How we engage subprocessors
Before engaging a new subprocessor, we conduct a due-diligence assessment of the subprocessor's security and privacy posture, confirm the legal mechanism for any cross-border transfer, and execute a written contract that limits the subprocessor's use to the purpose we specify.
3. Current subprocessor list
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Vercel Inc. | Hosting and content delivery for the empowered.guru website and certain client apps deployed on Vercel. | HTTP request metadata, application logs, content of requests to endpoints we host. | United States (with edge POPs globally) |
| Google LLC (Google Cloud Platform, Google Workspace) | Cloud infrastructure (some client engagements) and email / calendar / productivity. | Personal data stored in or processed by the services we provision for the engagement; email and calendar contents for communications with us. | United States (and the region selected per engagement) |
| Resend Inc. | Transactional email delivery (invoices, receipts, booking confirmations, security alerts). | Email addresses, message content, bounce and engagement metadata. | United States |
| Stripe Inc. | Payment processing for paid engagements. | Name, email, billing address, last four digits of payment card, transaction metadata. We do not transmit full card numbers to our systems. | United States (and the region selected per engagement) |
| GitHub Inc. | Source code hosting for client repositories and our own repos. | Repository contents, commit metadata, account identifiers. | United States |
| 1Password (AgileBits Inc.) | Secrets and credential management for our personnel. | Account credentials, API keys, and shared secrets used to operate the services. | Canada |
| OpenAI, L.L.C. | Optional AI inference for engagements that explicitly authorize hosted frontier-model use; subject to the engagement's SoW and our DPA. | Prompts and outputs scoped to the engagement; per OpenAI API data-use terms. | United States |
| Anthropic PBC | Optional AI inference for engagements that explicitly authorize hosted frontier-model use; subject to the engagement's SoW and our DPA. | Prompts and outputs scoped to the engagement; per Anthropic API data-use terms. | United States |
| Google LLC (Google Analytics 4) | Aggregated, anonymized website analytics. Loaded only after consent. | IP (anonymized), user agent, page paths, events. IP anonymization enabled. | United States |
| Zoho Corporation (Mail) | Email, calendar, and contact management for communications with us. | Email contents, calendar metadata, contact fields. | United States, European Union, India (region selected per account) |
| Centova Cast (for client streaming engagements) | Audio stream hosting and metadata management for radio-style client engagements. | Stream metadata, listener counts (aggregated), server logs. | United States and Canada (per engagement) |
| Drizzle ORM / Neon (for client database engagements) | Database hosting and ORM tooling for client apps. | Database contents for the engagement; access controlled by the engagement. | United States (with regional options) |
| Supabase (for client backend engagements) | Authentication, database, storage, and edge functions for client apps. | Database contents, auth records, storage objects, edge-function logs. | United States (and the region selected per engagement) |
Subprocessors added for a particular engagement (for example, a dedicated inference provider for a single Sovereign customer) are listed in the SoW and governed by the DPA. We do not use any subprocessor that requires a license or approval we have not obtained.
4. How we notify you of changes
We provide at least 15 days' advance written notice (email is sufficient) before adding a new subprocessor. The notice goes to the contact on file for each engagement with a DPA and to subscribers of the changelog (subscribe at legal@empowered.guru).
5. How to object
Clients with a DPA may object to a new subprocessor on reasonable grounds related to data protection within 15 days of the notice. We will work in good faith to address the objection; if unresolved, the Client may terminate the affected SoW for convenience without further liability except for fees earned to the date of termination.
6. Contact
Subprocessor questions: dpo@empowered.guru.