Sub-processors

1. About this list

AI Code That Works LLC, a Texas limited liability company doing business as Goosy Bear ("Goosy Bear," "we," "us," or "our") uses the sub-processors on this page to provide the Goosy Bear website and application (the "Service"). Each entry names the provider, its role, the categories of data it processes, and its primary operating location. Each sub-processor is bound by data-processing terms consistent with our Privacy Policy at https://goosybear.ai/privacy and, for business customers, with the Data Processing Addendum at https://goosybear.ai/dpa.

The connected-account providers a customer links to their own workspace — advertising platforms, social channels, CRMs, analytics properties — are not sub-processors: the customer owns those accounts and connects them directly. They are covered in the Privacy Policy's connected-accounts section.

2. The sub-processors

Each provider below processes personal data on our behalf, for the purpose stated, under its data-processing terms. A provider's DPA is linked where it is published; the rest are available on request.

• Supabase (United States) — Application database, authentication and file storage. Data categories: account, contact, usage, content. DPA: https://supabase.com/legal/dpa.
• Vercel (United States) — Website and application hosting, edge delivery and logs. Data categories: contact, technical. DPA: https://vercel.com/legal/dpa.
• GoHighLevel (United States) — CRM and marketing execution for submitted leads. Data categories: contact, marketing. DPA: on request.
• Anthropic (United States) — The models behind Goosy conversations and generation. Data categories: content. DPA: https://www.anthropic.com/legal/commercial-terms.
• Firecrawl (United States) — Public-page extraction for the Goosy trial and the Application's brand ingestion. Data categories: content. DPA: on request.
• PostHog (United States) — Product analytics and consent-gated session replay. Data categories: usage, technical. DPA: https://posthog.com/dpa.
• Sentry (United States) — Error monitoring and consent-gated replay. Data categories: technical. DPA: https://sentry.io/legal/dpa/.
• Mailgun (United States) — Transactional and operational email delivery. Data categories: contact. DPA: https://www.mailgun.com/legal/dpa/.
• Cloudflare (United States) — Turnstile bot protection on public forms. Data categories: technical. DPA: https://www.cloudflare.com/cloudflare-customer-dpa/.
• Stripe (United States) — Payment processing for subscriptions, credits, and invoices. Data categories: account, contact, billing. DPA: https://stripe.com/legal/dpa.
• Twilio (United States) — SMS delivery for customer messaging and notifications. Data categories: contact, content. DPA: https://www.twilio.com/en-us/legal/data-protection-addendum.
• OpenAI (United States) — AI models behind generation and assistant features. Data categories: content. DPA: https://openai.com/policies/data-processing-addendum/.
• Google (Gemini API) (United States) — Gemini model inference for generated text, image description, and image generation. Data categories: content. DPA: https://business.safety.google/processorterms/.
• Google (Vertex AI — Veo) (United States) — Vertex AI video generation for generated clips. Data categories: content. DPA: https://cloud.google.com/terms/data-processing-addendum.
• ElevenLabs (United States) — Voice generation and text-to-speech for generated media. Data categories: content. DPA: https://elevenlabs.io/dpa.
• HeyGen (United States) — Avatar video generation. Data categories: content. DPA: https://www.heygen.com/data-processing-addendum.
• Recraft (United States) — Image generation for brand and campaign assets. Data categories: content. DPA: https://www.recraft.ai/legal/dpa.
• Cleanvoice (European Union (Romania), with processing by its sub-processors in the EEA and the United States) — Audio cleanup for recorded and generated audio — filler, silence, and breath removal. Data categories: content. DPA: https://cleanvoice.ai/dpa/.
• Trigger.dev (United States (AWS us-east-1)) — Background job execution for renders, ingestion, and scheduled work. Data categories: content, technical. DPA: https://trigger.dev/legal/dpa.
• Browserbase (including Stagehand) (United States) — Hosted browser sessions for automated page navigation, including the Stagehand automation framework. Data categories: content, technical. DPA: on request.
• Tavily (United States) — Web search and page extraction for research features. Data categories: content. DPA: on request.
• Exa (United States) — Semantic search and similar-page discovery for research features. Data categories: content. DPA: https://exa.ai/dpa.
• Apify (European Union (Czech Republic)) — Public social-profile and page scraping for research features. Data categories: content. DPA: https://docs.apify.com/legal/data-processing-addendum.
• SearchAPI.io (United States) — Search-engine and ad-library research reads. Data categories: content. DPA: https://www.searchapi.io/legal/dpa.
• bunny.net (European Union (Slovenia), with global CDN delivery) — Video storage, encoding, and streaming delivery. Data categories: content, technical. DPA: on request.
• Google (Analytics and Tag Manager) (United States) — Site analytics and tag delivery on the production Site only, subject to the Consent Mode v2 consent rules in the privacy policy. Data categories: usage, technical. DPA: https://business.safety.google/adsprocessorterms/.

3. Updates to this list

We update this page when a sub-processor is added, replaced, or removed. A material addition is notified before it takes effect, following the change-notice terms in the Privacy Policy; business customers with a Data Processing Addendum also receive the notice and objection rights it describes.

AI Code That Works LLC, 2303 Ranch Road 620 S., Suite 160-240, Lakeway, TX 78734, United States. Effective 2026-08-25.