Sub-processors
Last updated 2026-09-27
These are the companies that process personal data so Hoxigen can run. Each one is bound by a written agreement that protects the data at least as well as our Data Processing Addendum does.
Who we engage
Our database and application run in the EU. Where a provider handles data outside the EEA and Israel, the row is marked and names the safeguard.
| Provider | What it does | Data involved | Where, and safeguard |
|---|---|---|---|
| Railway | Hosts the application, background worker, database and media storage | All account data and customer content | EU (Amsterdam, Netherlands); Railway is a US company · transfer outside the EEA Data is stored in the EU; Standard Contractual Clauses cover any access from the US |
| OpenRouter | Routes AI requests (text, images, speech, video, web search) to the model providers below | Prompts built from your app profile, instructions, knowledge base and prior content; generated output | United States · transfer outside the EEA Standard Contractual Clauses |
| AI model providers, through OpenRouter | Generate text, images, speech and video. Currently Google (Gemini), OpenAI, Anthropic, xAI, ByteDance (Seedance video), HeyGen (presenter video) and Fish Audio (speech) | The same prompts and output as OpenRouter; for presenter video, the script, presenter image and voice choice | United States and other countries, depending on the provider · transfer outside the EEA Standard Contractual Clauses |
| Exa, through OpenRouter | Web search for the AI visibility check | Search questions about your market and brand | United States · transfer outside the EEA Standard Contractual Clauses |
| Post for Me | Relays posts to Facebook, Instagram, LinkedIn, YouTube, X and TikTok, and returns their figures | Post content, media, account identifiers and access tokens | United States · transfer outside the EEA Standard Contractual Clauses |
| ScraperAPI | Retries a website check or scan when the site blocks our direct request | The public page address being fetched | United States · transfer outside the EEA Standard Contractual Clauses |
| Resend | Sends account email, and the newsletters you send to your leads | Recipient address, name and message content | United States · transfer outside the EEA Standard Contractual Clauses |
| SUMIT | Takes card payments and issues receipts | Billing name and email, card details (entered directly with SUMIT, never with us), transaction records | Israel EU adequacy decision for Israel |
| Slack | Delivers operational alerts to our own team | Sign-up name and email, workspace name, support requests with their screenshots, payment events | United States · transfer outside the EEA Standard Contractual Clauses |
| PostHog | Page analytics and session recordings on our public pages, after you accept; error reports from every page and our servers | Clicks, scrolling and pages viewed, with typed text masked; for errors, the error and where in our code it happened, the page address, the browser, and user, workspace and app ids | EU (Frankfurt, Germany) Stays in the EU |
| Microsoft Clarity | Heatmaps and session recordings on our public pages, after you accept | Clicks, scrolling and pages viewed, with typed text masked | United States · transfer outside the EEA EU-US Data Privacy Framework and Standard Contractual Clauses |
Text, image and speech requests go only to model endpoints that neither keep nor train on what we send (OpenRouter's zero data retention routing). Video generation and web search have no such endpoint, so those providers apply their own retention terms.
Services you choose to connect
When you connect one of these, it receives what you tell Hoxigen to send it and acts under its own terms with you. They are not our sub-processors; you can disconnect any of them at any time.
- Meta (Facebook, Instagram) — Publishes posts and stories; reads back posts, comments and engagement on the Pages you connect
- LinkedIn — Publishes posts as you or your Page; reads back engagement
- X — Publishes posts; reads public posts for Listening, where enabled
- Reddit — Publishes posts; reads public threads for Listening, where enabled
- Google (YouTube, Search Console, Analytics, Google sign-in) — Uploads videos; reads search and traffic reports for your site; signs you in with Google
- TikTok — Publishes videos, relayed by Post for Me
- Microsoft (Bing Webmaster Tools, Clarity) — Reads search and visitor reports for your site
- WordPress, Wix, Webflow, Shopify, or your own site by webhook — Publishes articles and images to your site
- Telegram — Sends you review and approval messages, if you connect a bot
When this list changes
We update this page before a new sub-processor starts receiving personal data, and email account owners at least 30 days ahead, except where a change is needed urgently to keep the service running or secure. To object to a change, write to legal@hoxigen.app within that period, as set out in section 6 of the DPA.
Contact
Privacy and data requests: legal@hoxigen.app · General: support@hoxigen.app
Related: Privacy policy · Terms of service · Data processing addendum · Cookie policy