OUTERCITELegal
Sub-processors
Every third party that processes personal data on our behalf, what it handles, and where.
Last updated:
1. About this list
Outer Cite Pty Ltd (ACN 649 728 101), trading as Outercite, uses the providers below to run the Services. Each is bound by a written agreement with data-protection terms at least as protective as our Data Processing Agreement. The location is where each provider primarily processes the data; some also use other regions.
We do not send your account profile, billing details or unrelated content to AI providers, and we ask, where providers allow it, that our traffic is excluded from model training.
2. Infrastructure we operate
We run our own servers on these hosts. The Sydney and United States servers are linked by an encrypted tunnel.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Vultr | Application hosting, PostgreSQL database, cache, backups | All Customer Content and account data | Sydney, Australia |
| Hetzner | Background workers, job queue, knowledge graph, prediction engine | Prompts, answers, job data, AI-referred visit records in transit | United States |
3. Core service providers
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Clerk | Sign-in, sessions, organisations | Name, email, authentication data | United States |
| Stripe | Subscriptions, payments, invoices | Billing contact, billing address, payment data | United States |
| Resend | Transactional and product email | Name, email, email content | United States |
| Sentry | Error tracking | Error context, user ID, IP address, browser data | United States |
| Concierge delivery partner | Reviews, change briefs and measurement for Concierge customers only, working as part of the Outercite team (identity on request) | Customer Content and contacts of the Concierge workspaces they work on | Works in our Sydney-hosted systems |
4. AI and search providers
These providers receive the prompts you track so we can measure, judge and explain AI answers. Prompts are business questions; do not put personal information in them.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| DeepSeek | Primary AI judge of every monitored answer; default assistant and writing model; DeepSeek monitoring | Prompts, answers, business and competitor names, draft content | China |
| OpenAI | ChatGPT monitoring; second check on low-confidence judgements | Prompts, answers, business and competitor names | United States |
| Anthropic | Claude monitoring; some writing tasks | Prompts, answers, business and competitor names, draft content | United States |
| Gemini monitoring | Prompts, business and competitor names | United States | |
| Perplexity | Perplexity monitoring; research enrichment | Prompts, business and competitor names | United States |
| xAI | Grok monitoring | Prompts, business and competitor names | United States |
| Search data provider | Google search results and AI Overviews for your prompts (identity on request) | Prompts, answer location | See note below |
Search data provider. We name this provider on request to privacy@outercite.com, including its location and terms. It receives the prompt text and the location the answer is checked from, not account or contact data.
5. Optional, when you turn them on
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Meta | Meta AI monitoring, where enabled for your workspace | Prompts, business and competitor names | United States |
| Search Console, Business Profile and Analytics connections you authorise | OAuth tokens, data from those accounts | United States | |
| Slack | Notifications to a workspace you connect | Alert content | United States |
| Twilio | WhatsApp and SMS alerts | Phone number, alert content | United States |
| Base and Pinata | Optional AI agent NFT identities | Hashed organisation ID, agent metadata (public once minted) | Public blockchain / IPFS |
6. Sales and marketing
We use these for our own sales and marketing, as controller. They do not receive Customer Content.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Google Analytics | Visit measurement on outercite.com | Cookie IDs, pages viewed, approximate location | United States |
| Pipedrive | Sales pipeline | Name, email, company of prospects and new signups | European Union |
| lemlist | Business outreach email | Name, business email, company of prospects | European Union |
7. Changes and objections
We update this page before a new sub-processor starts handling Customer Content. If you have a signed DPA with us, we also email your primary contact at least 14 days before the change. You may object in writing during that period on reasonable data-protection grounds; we will work with you on an alternative, and if none is possible you may end the affected Services and receive a refund of prepaid fees for the unused period.
Questions: privacy@outercite.com