Sub-processors and External Platforms List
Effective date: 27 September 2026
This page is intended to show transparently the main infrastructure providers used for Performance Intelligence and the Dreavion Technology corporate site, together with the categories of external platform that can be connected at the customer’s request.
Listing a service here does not mean data is transferred to it from every customer account. Data is transferred to an external platform only where the customer uses the relevant integration or where the service requires that technical component.
The list is divided into three groups. Group A lists the sub-processors Dreavion Technology engages to process Customer Data under the Data Processing Agreement. Group B lists platforms the customer connects or enables at its own instruction. These are not Dreavion sub-processors. Group C lists providers Dreavion Technology uses for its own operations, where Dreavion Technology is the controller or the provider acts independently.
A. Sub-processors for Customer Data
Provider / Platform
Vercel
General role
Hosting and running the Performance Intelligence application
Data types that may be processed
Technical request and application data, logs and connection metadata
Condition of use
Platform infrastructure
Application hosting and execution
EU region — Frankfurt (fra1)
Provider / Platform
Supabase
General role
Database, authentication and private file storage
Data types that may be processed
User and account data, product data, encrypted integration credentials, report files
Condition of use
Platform infrastructure
Database, authentication, file storage
EU region — Frankfurt (eu-central-1)
Provider / Platform
OpenAI
General role
AI model provider used to generate Scout analyses and responses
Data types that may be processed
Questions entered into Scout, earlier questions in the same conversation where relevant, and relevant performance metrics and campaign, page and search-query labels. User names, email addresses, lead contact data and account identifiers are not intentionally included by Dreavion in the Scout context sent to OpenAI.
Condition of use
Processing occurs when Scout is used.
Processing
OpenAI API infrastructure. Dreavion does not currently use a dedicated regional data-residency configuration for OpenAI. OpenAI API data is not used to train models by default unless explicitly opted in. Standard abuse-monitoring logs may be retained by OpenAI for up to 30 days.
Provider / Platform
Resend
General role
Transactional email delivery for Performance Intelligence, such as sign-up verification codes, password reset and team invitation emails
Data types that may be processed
Recipient email address, email content such as verification codes and invitation links, and delivery and event metadata
Condition of use
When Performance Intelligence sends platform emails
Processing
Resend may process and store data outside the European Economic Area. The region an email is sent from is not the same as the location where Resend stores message and log data.
B. Platforms connected or enabled by the customer
Provider / Platform
Google
General role
Google Analytics, Google Ads, Search Console and related Google integrations
Data types that may be processed
Performance, account or property and search data the customer has authorized
Condition of use
Only if the relevant Google integration is used
Provider / Platform
Meta
General role
Meta Ads / Marketing API connection
Data types that may be processed
Ad account performance data the customer has authorized
Condition of use
Only if the relevant Meta integration is used
Provider / Platform
TikTok
General role
TikTok Ads / TikTok API for Business connection
Data types that may be processed
Ad account performance data the customer has authorized
Condition of use
Only if the relevant TikTok integration is used
Provider / Platform
Telegram
General role
Notification and report delivery channel
Data types that may be processed
Channel or chat identifier, notifications and reports sent
Condition of use
Only if the customer enables Telegram delivery
Provider / Platform
Platforms supported in future
General role
Advertising, analytics, e-commerce, marketplace, messaging or other user-initiated integrations
Data types that may be processed
Only the data required for the relevant feature to work
Condition of use
When the customer uses the relevant integration
C. Providers for Dreavion Technology’s own operations
Provider / Platform
Framer
General role
Hosting the dreaviontechnology.com corporate site
Data types that may be processed
Site visit data and form or technical data submitted through the site, depending on the features used
Condition of use
Corporate site infrastructure
Provider / Platform
Google (Google Analytics 4)
General role
Website analytics for the dreaviontechnology.com corporate site
Data types that may be processed
Pages viewed, interactions, device and browser information, approximate location and pseudonymous cookie identifiers
Condition of use
Corporate website only, and only after the visitor accepts analytics cookies. See the Cookie Policy.
Provider / Platform
Cloudflare (Turnstile)
General role
Bot and abuse protection on Performance Intelligence registration and account recovery forms
Data types that may be processed
Browser and connection signals such as IP address, TLS fingerprint and User-Agent
Condition of use
When a protected form is used. Cloudflare acts as a processor for the signals used to secure the form, and as a separate controller when it uses signals to improve Turnstile’s bot detection.
Provider / Platform
Paddle
General role
Payment provider and merchant of record for paid Performance Intelligence subscriptions
Data types that may be processed
Billing name, email address, billing country, payment method details and transaction records collected at checkout
Condition of use
Only when a paid plan is purchased. Paddle sells the subscription as merchant of record and processes payment data as a separate controller under its own terms.
Processing and transfer abroad
Some of the providers above may operate outside Türkiye or process data on international infrastructure. Any transfer of personal data abroad must rest on an applicable KVKK transfer mechanism and, where the GDPR applies, on a mechanism permitted by Chapter V of the GDPR.
Processing location and transfer mechanism per provider: where a location has been verified, it is shown in the table above. Where no location is shown, the provider may process data outside Türkiye and outside the European Economic Area. The transfer mechanism depends on the transfer relationship concerned, as described in section 1.9 of the Data Processing Agreement and section 1.15 of the Privacy Policy.
This list may be updated as the infrastructure or integration portfolio changes.