Subprocessors

Supabase (Supabase Inc., US) — database, authentication, file storage, edge functions. The database runs in the EU (Frankfurt, eu-central-1). Sees: account identity, generated apps and their HTML, app end-user data, billing ledger, support tickets.

Cloudflare (Cloudflare Inc., US) — hosting of the platform and published apps (Workers), DNS, CDN, custom domains, Zero Trust access for admin consoles, and encrypted backup storage (R2). Sees: request metadata, IP addresses, traffic in transit, custom domain names; in backups the database dump is encrypted with a key Cloudflare does not hold, and the media/upload copy is kept in a private bucket.

Vercel AI Gateway (Vercel Inc., US) — the SINGLE general gateway every AI request passes through (builds, chat, assistants, in-app AI, images, video, speech and transcription). Sees: prompts, briefs, images you attach, the HTML of an app being edited, and generated output; for in-app AI and site assistants, what your app's end users type. There is no second gateway and no silent fallback vendor: if the gateway is unavailable the request fails with a stated reason.

Sentry (Functional Software Inc., US) — server error monitoring and sampled performance tracing. Sees: the route and stack trace of an error and the user's id only. Before sending, request bodies, cookies and headers are dropped and email-, key- and token-like text is masked.

The gateway forwards each request to the developer of the model you or the platform selected, or to a host the gateway selects to serve that model; it sees what the gateway sees for that request.

Most requests, defaults and Auto: Anthropic, OpenAI, Google. Also on the curated list: Z.ai (Zhipu), DeepSeek. Selectable under "Other models": xAI, Mistral AI, Alibaba (Qwen), Moonshot AI, MiniMax, Meta (Llama). Images: OpenAI (default), Google, Black Forest Labs, ByteDance. Video: Google (default), Alibaba, ByteDance, Kling AI, xAI. Speech and transcription: OpenAI.

Some of these developers are established outside the US and the EU (Z.ai, DeepSeek, Alibaba, Moonshot AI and MiniMax in China). When such a model is selected — by you, or by a platform step that uses one (e.g. Think's multi-model council, translation or a fallback chain) — the request may be processed there.

Runware — an alternative for app builds and image generation that applies only when an administrator explicitly selects it. It is NOT selected today and processes nothing.

Stripe — subscriptions, one-time purchases, customer portal, invoices. Sees: name, email, billing address, tax id, payment method. CARD NUMBERS never reach DevAny — they exist only inside Stripe.

Resend (Resend Inc., US) — transactional email and the email your apps send (notifications, campaigns, reminders). Sees: recipient address and message body.

Google (Google LLC, US) — "Sign in with Google". Sees: name, email, profile picture at sign-in.

GitHub Actions (GitHub Inc., US) — runs the daily backup job and the restore drill. During the drill the encrypted dump is decrypted on a temporary GitHub runner and loaded into a temporary database, both discarded with the runner when the job ends.

Google Analytics (GA4) and Google Ads conversion tracking (Google LLC, US) — usage measurement on the site and the signed-in console. Storage permissions stay denied until you consent; declining the banner or sending a GPC signal means no measurement cookie is written.

These tags are NEVER loaded into apps our customers build: a published app or a site on a custom domain carries none of our tags, enforced in code (a missing surface marker reads as 'none', not 'measure').

Unsplash (primary) and Pexels (fallback) — stock photo search; in a search they see only the query derived from the brief. Because these photos are displayed from the provider's own address on a published site, a visitor's browser fetches each photo directly from the provider, which sees that visitor's IP address.

Google Fonts — font delivery on marketing pages (visitor IP when a font is fetched); apps you build open no connection to Google Fonts.

"Push to GitHub" — when you connect your own GitHub account, the HTML of the app you choose is written to YOUR repository.

Webhooks and actions (e.g. a Zapier Catch Hook or any URL) — send your app's records or an action's request to the address you set.

Connected AI apps (assistants such as ChatGPT, Claude or Cursor that you connect through "Sign in with DevAny" or an API key) — the data the assistant requests within the permissions you granted goes to that assistant's provider. Details: Privacy Policy §6.

You choose and control these destinations; the providers there are your subprocessors. DevAny only delivers where you point it.

No advertising network beyond the Google Ads conversion tag above. No social-media pixels. No data broker, enrichment or profiling service. Customer data is never sold or shared for anyone else's marketing.

The primary database and file storage are in the EU (Supabase, Frankfurt); hosting is on Cloudflare's global edge, and AI requests are processed in the countries of the providers above. DevAny does not currently offer regional data residency and does not claim to.