Sub-processors
AdPilot engages the third-party service providers listed below to operate the Service. Each is bound by a written agreement that includes confidentiality and security obligations. New sub-processors are announced here at least 30 days before they go live so Customers can object on reasonable grounds — see Section 5 of our DPA.
To receive email notifications when this page changes, email office@shuhaimarketing.ca with the subject "Subprocessor notifications".
Current sub-processors
| Vendor | Purpose | Data | Region | DPA |
|---|---|---|---|---|
| Neon Inc. (Neon Postgres) | Primary application database | Account, workspace, brand profile, audit log, ad metadata | United States (AWS US-East-2) | link |
| DigitalOcean LLC | Application hosting, uploads storage, cron jobs | All Service-side data in transit and at rest on the droplet | Canada (TOR1) / United States | link |
| Stripe, Inc. | Payments and subscription billing | Billing contact, card metadata (last 4, brand), invoice records, tax data | United States | link |
| Resend, Inc. | Transactional email (welcome, password reset, alerts) | Email address, email content, delivery status | United States | link |
| Google LLC (Gemini API) | LLM analysis, copy generation, agent reasoning | Prompts (brand profile, ad performance summaries, user questions) — no payment data, no lead PII | United States (data not used to train Google's foundation models on paid Vertex API tier) | link |
| Kie.ai (image generation) | Generating creative images via gpt-image-2 / nano-banana-2 | Prompt text and reference image URLs (photo uploads, logos) | United States | link |
| Meta Platforms, Inc. | Read/write access to Customer's Facebook and Instagram ad accounts via the Marketing API | Customer-authorised ad account, page, and ad insights data | United States | link |
| Google LLC (OAuth and Workspace login) | Optional Google Sign-In for Customer users | Email, name, profile photo (where Customer chose Google Sign-In) | United States | link |
| Vercel, Inc. | Hosting marketing site at manager.shuhaimarketing.com | Form submissions for the waitlist, page analytics (aggregate) | United States | link |
| PostHog, Inc. | Product analytics and session replay inside the dashboard | Pageviews, clicks and navigation events, user and workspace identifiers, session replays — form input values are masked before they leave the browser | United States (us.i.posthog.com) | link |
| Telegram FZ-LLC / Telegram Messenger Inc. | Optional Telegram channel — alerts, scheduled reports, and chat with the AdPilot agent, where the Customer pairs a chat | Telegram chat ID and username, and the content of messages exchanged with the bot (ad performance summaries, the Customer's own questions and replies) | Global — message routing is not region-pinned | link |
Two entries need a word of explanation. Telegram is engaged only where a Customer chooses to pair a Telegram chat; if no chat is paired, no data reaches Telegram at all. Telegram does not publish a standard data processing agreement, so the link above points to its privacy policy. PostHog records dashboard usage and session replays with form inputs masked in the browser, so values typed into fields are never transmitted.
Proposed sub-processors (30-day notice)
None at this time.
Internal access
Within Shuhai Marketing, production access is restricted to named administrators and tracked. Customer Support may access workspace metadata when responding to support requests; AdPilot will never write changes to a Customer's Meta account except (a) when the Customer confirms the change in-product, or (b) when the Customer explicitly asks Support to do so and confirms in writing.