Subprocessors
The providers we use to run Grades.com, what each one does for us, which data it receives and where it works. Last updated October 30, 2026.
| Provider | What it does for us | Data it receives | Where | Terms |
|---|---|---|---|---|
| Google Cloud (Google LLC) | Hosting, database, file storage, logs, encryption keys and scheduled jobs | Everything in the service: accounts, businesses, reviews, contacts, uploads | United States (us-east4, Virginia) | Cloud data processing terms |
| Google AI models (Gemini, Google LLC) | Reply drafts, sorting reviews, checking drafts against your rules, removal-report drafts, directory summaries, our own support inbox | Review text, business details and your instructions; for healthcare businesses, conditions, treatments and amounts are replaced with placeholders first | Google Cloud (Vertex AI): text models on the global endpoint, which does not fix a region; embeddings in us-east4 | Cloud data processing terms |
| Anthropic (Claude) | Ask Grades in the dashboard; AI Reputation and Competitor Map questions | The question asked and the data the assistant reads to answer it; fixed questions about a business | Anthropic's data centers | Commercial terms |
| DataForSEO | Business listings, Google reviews and search results; it also passes our AI Reputation questions to ChatGPT, Perplexity and Gemini | Business names, addresses and websites, and fixed questions about a business; never your contact lists | DataForSEO's data centers | Terms of service |
| OpenAI (ChatGPT), through DataForSEO | Answers to AI Reputation questions | Only the fixed question about a business | OpenAI's data centers | Business terms |
| Perplexity, through DataForSEO | Answers to AI Reputation questions | Only the fixed question about a business | Perplexity's data centers | Terms of service |
| Apify | Collecting public reviews and profile pages from review sites, and search results | Addresses of public pages; never your contact lists | Apify's cloud | Legal documents |
| Bright Data | Fetching public web pages that block plain requests. For the review-site accounts you connect for actions the agent takes in a browser (today Yelp and Healthgrades), the agent reaches the site through Bright Data's US network, and a page that shows a CAPTCHA may be completed in Bright Data's browser with that account's session. | Addresses of public pages; for connected accounts, the browser session of that account | United States network locations | Legal documents |
| Mailgun | Sending service emails (sign-in, alerts, digests, billing notices) and review-request emails | Recipient addresses and the message | United States (Mailgun's US region) | Legal documents |
| Twilio | Sending review requests by text message (once text campaigns are live) | Phone numbers and the message | Twilio's data centers | Legal documents |
| Stripe | Payments and billing | Billing contact and payment details (card details are held by Stripe, never by us) | Stripe's data centers | Legal documents |
| Google Workspace (Google LLC) | Our own mailboxes, such as support@grades.com and terms@grades.com | What you write to us | Google's data centers | Workspace data processing terms |
About this list
- "Where" names the region when we choose it: Google Cloud us-east4 (Virginia) for hosting and storage, Mailgun's US region for email, and US network locations at Bright Data. Gemini text models run on Google Cloud's global endpoint, which does not fix a region. The other providers process what they receive in their own data centers.
- Review sites and platforms you connect yourself, such as your Google Business Profile or Facebook page, are not on this list: their own terms apply to them.
- We tell customers at least 30 days before we add or replace a subprocessor that processes customer personal data, as the Data Processing Agreement says.
- More on how we handle data: Security and trust and the Privacy Policy, section 7. Questions to terms@grades.com.