Subprocessors
Effective date: August 25, 2026
DevAny LLC — Wyoming, United States · 30 N Gould St, Ste R, Sheridan, WY 82801, USA · Registration no: 2026-002023768 (Wyoming SoS) · hello@devany.ai · +1 (213) 585-1343
The current list of third parties that may process customer data on behalf of DevAny LLC (Wyoming, United States). This is not a vendor showcase: it was compiled by enumerating the services the code actually calls, and adding a service that touches customer data means updating this page in the same change. Questions: hello@devany.ai.
1. Core infrastructure — always in the path
Supabase — database, authentication, file storage, edge functions. Sees: account identity, generated apps and their HTML, app end-user data, billing ledger, support tickets.
Cloudflare — application hosting (Workers), DNS, CDN, Zero Trust access for admin consoles. Sees: request metadata, IP addresses, traffic in transit.
AI gateway — the SINGLE general gateway every textual generation passes through. Sees: prompts, briefs and generated output. There is no second gateway and no silent fallback vendor: if the gateway is unavailable the request fails with a stated reason instead of being rerouted.
2. Payments and email
Stripe — subscriptions, one-time purchases, customer portal, invoices. Sees: name, email, billing address, tax id, payment method. CARD NUMBERS never reach DevAny — they exist only inside Stripe.
Resend — transactional email (welcome, billing, support, alerts). Sees: recipient address and message body.
Google (OAuth) — "Sign in with Google". Sees: name, email, profile picture at sign-in.
3. Measurement — consent-based only
Google Analytics (GA4) and Google Ads conversion tracking — usage measurement on the site and the signed-in console. Storage permissions stay denied until you consent; declining the banner or sending a GPC signal means no measurement cookie is written.
These tags are NEVER loaded into apps our customers build: an app at /a/ or on a custom domain carries none of our tags, enforced in code (a missing surface marker reads as 'none', not 'measure').
4. Media and content — only when the feature is used
Pexels (primary) and Unsplash (secondary) — stock photo search; they see only the query derived from the brief. Pixabay — legacy photos in apps built earlier. Google Fonts — font delivery on marketing pages (visitor IP when a font is fetched).
5. Not used — absence is a commitment too
No advertising network beyond the Google Ads conversion tag above. No social-media pixels. No data broker, enrichment or profiling service. Customer data is never sold or shared for anyone else's marketing.
6. Data location
Primary storage is in the Supabase project's region; hosting is on Cloudflare's global edge. DevAny does not currently offer regional data residency and does not claim to.