Subprocessors

Last updated: 31 July 2026

NitroShock is operated by DevWave Software Inc. To run the service we use a small number of third party providers. This page lists every one of them, what it receives, and where it operates.

We publish this so an agency can answer its own client, and so a compliance team can check us without having to ask. If you have a data processing agreement with us, this page is the current subprocessor list referred to in it.

Subprocessors

These providers process customer data on our behalf in order to deliver a feature.

DataForSEO

Purpose: search engine results data, keyword metrics, backlink data and site audit crawling. This is the supplier behind rank tracking, keyword research, competitor analysis and the audit tools.

What it receives: the keywords you track, your domain, competitor domains, and target page URLs, together with the location, language and device you selected. It does not receive your name, email address, payment details or Search Console data.

Location: United States.

Anthropic

Purpose: the AI behind content generation, rewriting, FAQ and brief building, image alt text, and the support chat on this website.

What it receives: the prompt for the task, which can include your brand name, domain, keywords, a topic, and any text you asked us to write or rewrite. Anything you type into the support chat is sent to answer you.

Location: United States.

OpenAI

Purpose: one of the assistants queried by the AI visibility feature, which checks whether your brand is mentioned in AI generated answers.

What it receives: the generated question about your market, and your brand name and domain.

Location: United States.

Google LLC

Purpose: two separate roles. Gemini is one of the assistants queried by the AI visibility feature. Separately, Google Search Console is the source of the search data you choose to connect, and Google Fonts serves typography on this website.

What it receives: for AI visibility, the generated question plus your brand and domain. For the Search Console connection, the identity of the property you selected and the date range we are requesting, in order to read your data back. For fonts, your browser's IP address and user agent when you load a page.

Location: United States and global.

Perplexity

Purpose: one of the assistants queried by the AI visibility feature.

What it receives: the generated question about your market, and your brand name and domain.

Location: United States.

Cloudflare

Purpose: our edge network. It runs the workers that call the providers above, caches results, and processes image optimisation.

What it receives: in practice everything the platform sends outward passes through it, including keywords, domains, page content, AI prompts and responses, and images you upload for optimisation. Cached results are held at the edge.

Location: global. Requests are handled at the location nearest the person making them.

OVH

Purpose: hosting for our application servers and database.

What it receives: as our hosting provider it holds all data stored by the platform at rest.

Location: Canada.

Stripe

Purpose: payment processing for subscriptions and credit purchases.

What it receives: your email address, the plan and amount, and your card details, which you enter directly into Stripe's own payment form. Card numbers do not pass through our servers and we never store them.

Location: United States.

Other Third Parties Your Browser Contacts

These are not subprocessors, because we do not send them your data. They are named because loading a page causes your browser to contact them directly, which reveals your IP address and browser string to them.

• jsDelivr and Cloudflare cdnjs, which serve the charting and editor libraries used in the dashboard.
• Google Fonts, which serves the typefaces used across the site.
• Gravatar, operated by Automattic, which serves account avatars. It receives an irreversible hash of your email address rather than the address itself.
• Stripe, whose payment form loads directly in your browser at checkout.

Changes to This List

We update this page when a provider is added or removed. If you have a data processing agreement with us that requires advance notice of a new subprocessor, we will give you that notice by email to your account address before the change takes effect.