1. About this list
AI Code That Works LLC, a Texas limited liability company doing business as Goosy Bear ("Goosy Bear," "we," "us," or "our") uses the sub-processors on this page to provide the Goosy Bear website and application (the "Service"). Each entry names the provider, its role, the categories of data it processes, and its primary operating location. Each sub-processor is bound by data-processing terms consistent with our Privacy Policy at https://goosybear.ai/privacy and, for business customers, with the Data Processing Addendum at https://goosybear.ai/dpa.
The connected-account providers a customer links to their own workspace — advertising platforms, social channels, CRMs, analytics properties — are not sub-processors: the customer owns those accounts and connects them directly. They are covered in the Privacy Policy's connected-accounts section.
2. The sub-processors
| Processor | Purpose | Data categories | Location | DPA |
|---|---|---|---|---|
| Supabase | Application database, authentication and file storage | account, contact, usage, content | United States | DPA |
| Vercel | Website and application hosting, edge delivery and logs | contact, technical | United States | DPA |
| GoHighLevel | CRM and marketing execution for submitted leads | contact, marketing | United States | On request |
| Anthropic | The models behind Goosy conversations and generation | content | United States | DPA |
| Firecrawl | Public-page extraction for the Goosy trial and the Application's brand ingestion | content | United States | On request |
| PostHog | Product analytics and consent-gated session replay | usage, technical | United States | DPA |
| Sentry | Error monitoring and consent-gated replay | technical | United States | DPA |
| Mailgun | Transactional and operational email delivery | contact | United States | DPA |
| Cloudflare | Turnstile bot protection on public forms | technical | United States | DPA |
| Stripe | Payment processing for subscriptions, credits, and invoices | account, contact, billing | United States | DPA |
| Twilio | SMS delivery for customer messaging and notifications | contact, content | United States | DPA |
| OpenAI | AI models behind generation and assistant features | content | United States | DPA |
| Google (Gemini API) | Gemini model inference for generated text, image description, and image generation | content | United States | DPA |
| Google (Vertex AI — Veo) | Vertex AI video generation for generated clips | content | United States | DPA |
| ElevenLabs | Voice generation and text-to-speech for generated media | content | United States | DPA |
| HeyGen | Avatar video generation | content | United States | DPA |
| Recraft | Image generation for brand and campaign assets | content | United States | DPA |
| Cleanvoice | Audio cleanup for recorded and generated audio — filler, silence, and breath removal | content | European Union (Romania), with processing by its sub-processors in the EEA and the United States | DPA |
| Trigger.dev | Background job execution for renders, ingestion, and scheduled work | content, technical | United States (AWS us-east-1) | DPA |
| Browserbase (including Stagehand) | Hosted browser sessions for automated page navigation, including the Stagehand automation framework | content, technical | United States | On request |
| Tavily | Web search and page extraction for research features | content | United States | On request |
| Exa | Semantic search and similar-page discovery for research features | content | United States | DPA |
| Apify | Public social-profile and page scraping for research features | content | European Union (Czech Republic) | DPA |
| SearchAPI.io | Search-engine and ad-library research reads | content | United States | DPA |
| bunny.net | Video storage, encoding, and streaming delivery | content, technical | European Union (Slovenia), with global CDN delivery | On request |
| Google (Analytics and Tag Manager) | Site analytics and tag delivery on the production Site only, subject to the Consent Mode v2 consent rules in the privacy policy | usage, technical | United States | DPA |
| Railway | Application hosting for the always-on automation service that runs scheduled and signal-driven work | content, technical | United States | DPA |
| Upstash | Managed Redis data store for the automation service's queue and stream state, and for distributed rate limiting on the public sites | content, technical | United States | DPA |
| fal.ai | Model serving for generated video and images — the third-party media generation plane | content | United States, with processing by its service providers in the United States and other countries | DPA |
| Fireworks AI | Hosted serving of open-weight text models behind code generation and model evaluation runs | content | United States, with processing by its sub-processors in the United States, Japan, Germany, the United Kingdom and Iceland, and global CDN delivery | DPA |
3. Updates to this list
We update this page when a sub-processor is added, replaced, or removed. A material addition is notified before it takes effect, following the change-notice terms in the Privacy Policy; business customers with a Data Processing Addendum also receive the notice and objection rights it describes.
Questions about a sub-processor, or a request for a provider's DPA:
Talk to Goosy — goosy@goosybear.ai
AI Code That Works LLC, 2303 Ranch Road 620 S., Suite 160-240, Lakeway, TX 78734, United States. Effective 2026-09-13.