Subprocessors

NitroShock is operated by DevWave Software Inc. To run the service we use a small number of third party providers. This page lists every one of them, what it receives, and where it operates.

We publish this so an agency can answer its own client, and so a compliance team can check us without having to ask. If you have a data processing agreement with us, this page is the current subprocessor list referred to in it.

Subprocessors

These providers process customer data on our behalf in order to deliver a feature.

DataForSEO

Purpose: search engine results data, keyword metrics, backlink data and site audit crawling. This is the supplier behind rank tracking, keyword research, competitor analysis and the audit tools.

What it receives: the keywords you track, your domain, competitor domains, and target page URLs, together with the location, language and device you selected. It does not receive your name, email address, payment details or Search Console data.

Location: United States.

Anthropic

Purpose: the AI behind content generation, rewriting, FAQ and brief building, image alt text, and the support chat on this website.

What it receives: the prompt for the task, which can include your brand name, domain, keywords, a topic, and any text you asked us to write or rewrite. Anything you type into the support chat is sent to answer you.

Location: United States.

OpenAI

Purpose: one of the assistants queried by the AI visibility feature, which checks whether your brand is mentioned in AI generated answers.

What it receives: the generated question about your market, and your brand name and domain.

Location: United States.

Google LLC

Purpose: Gemini is one of the assistants queried by the AI visibility feature. Google's other roles, as the source of the Search Console data you connect and as the host of the fonts your browser loads, are described in the two sections below, because neither is processing on our behalf.

What it receives: the generated question about your market, and your brand name and domain.

Location: United States.

Perplexity

Purpose: one of the assistants queried by the AI visibility feature.

What it receives: the generated question about your market, and your brand name and domain.

Location: United States.

Cloudflare

Purpose: our edge network. It runs the workers that call the providers above, caches results, and processes image optimisation.

What it receives: in practice everything the platform sends outward passes through it, including keywords, domains, page content, AI prompts and responses, and images you upload for optimisation. Cached results are held at the edge.

Location: global. Requests are handled at the location nearest the person making them.

OVH

Purpose: hosting for our application servers and database.

What it receives: as our hosting provider it holds all data stored by the platform at rest.

Location: Canada.

Stripe

Purpose: payment processing for subscriptions and credit purchases.

What it receives: your email address, the plan and amount, and your card details, which you enter directly into Stripe's own payment form. Card numbers do not pass through our servers and we never store them.

Location: United States.

Data Sources You Connect

These are not subprocessors. They hold data that belongs to you, which we read only after you explicitly authorise the connection.

Google Search Console

Role: the source of the search performance data you choose to connect. We request read-only permission (webmasters.readonly) and cannot change anything in your Google account.

What we send: the identity of the property you selected and the date range being requested, in order to read your data back.

What we do with it: processing happens on our own servers. Search Console data is not sent to any AI provider, is not used to train models, and is not transferred to any other provider listed on this page.

Other Third Parties Your Browser Contacts

These are not subprocessors, because we do not send them your data. They are named because loading a page causes your browser to contact them directly, which reveals your IP address and browser string to them.

• jsDelivr and Cloudflare cdnjs, which serve the charting and editor libraries used in the dashboard.
• Google Fonts, operated by Google LLC, which serves the typefaces used across the site. It receives your browser's IP address and user agent when a page loads.
• Gravatar, operated by Automattic, which serves account avatars. It receives an irreversible hash of your email address rather than the address itself.
• Stripe, whose payment form loads directly in your browser at checkout.

Changes to This List

We update this page when a provider is added or removed. If you have a data processing agreement with us that requires advance notice of a new subprocessor, we will give you that notice by email to your account address before the change takes effect.