Sub-processors
Who else touches your data, what they do with it, and how you are told when that changes.
The Short Version
A summary of what matters most, in ordinary language. It is a guide to the document below, not a replacement for it — where the two differ, the full text governs.
The list is short on purpose
Fewer processors means fewer places your data can go and fewer agreements to police. Every addition has to earn its place.
Model providers do not train on your content
Content is sent to fulfil your request and is covered by the providers' commercial terms, which exclude training on API data.
You will be told before the list changes
Notice of a new sub-processor is given to account holders before it starts processing, so you have the chance to object.
Google and WordPress are yours, not ours
Where you connect your own accounts, the access is granted by you, scoped, and revocable directly with the provider at any time.
Pending legal review. This document describes how the product actually works, but it has not yet been reviewed by a qualified lawyer and the bracketed fields below still need completing. Do not rely on it as final terms.
What A Sub-processor Is
When you use Docket, Docket Ltd. acts as a processor of personal data on your behalf, and you are the controller. A sub-processor is a third party we engage that may process that data in the course of providing the service.
This page is the current list. It is referenced by the Data Processing Addendum and is maintained as the authoritative version.
Infrastructure
| Provider | What it does | What it may process |
|---|---|---|
| Supabase | Managed PostgreSQL database, authentication and file storage. This is where your account, websites, topics, drafts and generated images live. | Account details, all content you create or generate, and encrypted third-party credentials |
| Lovable | Application hosting and the AI gateway that routes generation requests to model providers. | Request and response content in transit, application logs |
| Cloudflare | Edge delivery, TLS termination and protection against abuse. | Request metadata such as IP address and user agent, in transit |
Model Providers
| Provider | What it does | What it may process |
|---|---|---|
| OpenAI | Writes drafts, plans topics, researches with web search, and answers tracked questions for AI visibility measurement. | Your brand profile, briefs, drafts and tracked questions |
| Google (Gemini) | Short structured work such as topic planning and page audits, article imagery, and answering tracked questions for AI visibility measurement. | Your brand profile, briefs and tracked questions |
Every request to these models is routed through the Lovable AI gateway. Docket holds no account or key with any model provider directly. Content is sent to these providers only to fulfil a request you have made. Under their commercial API terms, data submitted through the API is not used to train their models. Docket does not train any model of its own.
Only If You Enable Them
Docket sends no marketing or digest email, so there is no email sub-processor to disclose.
Your own connections are not sub-processors. When you connect Google Search Console, Google Analytics or your WordPress site, you are granting Docket access to systems you already control. That access is read-only in the case of Google, scoped, and revocable by you at any time directly with the provider.
Changes To This List
Before a new sub-processor begins processing personal data on your behalf, account holders will be notified. If you have a reasonable objection on data protection grounds, tell us: we will work with you to find an alternative, and if none exists you may terminate without penalty for the remainder of the term.
To be added to change notifications, or to ask about any entry here, write to support@docket.ltd.
Questions about this document? support@docket.ltd