Last updated October 20, 2026
helloAISearch is operated by PulseSpark.ai LLC. To run the Service we rely on a small number of other companies, called subprocessors, that handle data on our behalf and under our instructions.
This page lists each subprocessor, the purpose for which we engage it, the categories of data it receives, and the country in which it processes that data. It is the list referenced by section 4 of our Privacy Policy and is incorporated by reference into section 6 of our Data Processing Agreement. We will update this page as providers change.
Primary database and authentication infrastructure.
Account identifiers and email address, authentication records, project configuration, tracked prompts, competitor sets, scan results, and related application data. For a free-tool report you ask us to email, also the email address, the tool used, the time of the request, and the report contents.
United States
Hosting and delivery of the web application.
Request metadata, including IP address and browser information, and server logs.
United States for application servers and logs. Requests are routed through Vercel's global edge network, so request metadata is handled at the edge location nearest the visitor before reaching the United States.
Infrastructure that runs background scans and processing jobs, including the job queue.
Prompt text and scan results required to run a job, held while the job runs, and operational logs. Also the rate-limit counters for the free tools, keyed by a hashed IP address and kept for 24 hours.
United States
Payment processing and subscription billing.
Name, email address, billing address, and invoice history. Card numbers are sent to Stripe directly by your browser and are never received or stored by us.
United States
Delivery of transactional and notification email.
Email address and the content of each message we send you. No prompts, scan results, or billing details.
United States
Product analytics and session replay inside the application. Loads only after you accept analytics; nothing is sent and no cookie is set before then.
Product usage events, device and browser information, an account identifier, IP address, and masked session recordings. All on-screen text and typed input are masked in your browser before a recording is sent, and no recording runs on sign-in, sign-up, password reset, email verification, upgrade, or Settings pages.
United States
Traffic measurement on our marketing pages. Loads only after you accept analytics.
Page views, device and browser information, and IP address.
United States
Measuring whether our ads in ChatGPT led to a free trial or a paid subscription, starting 14 days after the customer notice email and not before November 3, 2026. Loads only after you accept analytics and ad measurement; nothing is sent and no cookie is set before then. Events are marked to opt out of personalization.
Ad click and browser references (first-party cookies __oppref and __obref), the conversion event and plan, for a subscription the amount and currency, SHA-256 hashes of the email address and account ID, and for the trial event IP address and browser user agent.
United States
Error monitoring and diagnostics. Error reports are necessary to keep the Service working and are not covered by the analytics choice. The masked, error-triggered recording is: it does not run unless you accept analytics.
Error reports, browser and device information, and IP address. If you have accepted analytics, also a masked session replay captured only when an error occurs.
United States
AI response generation used for visibility measurement (ChatGPT).
The text of each prompt you track, sent as written, which may include brand, product, and competitor names. We do not attach account identifiers, credentials, contact details, or payment information; anything you include in the prompt text itself is transmitted.
United States
AI response generation used for visibility measurement (Claude).
The text of each prompt you track, sent as written, which may include brand, product, and competitor names. We do not attach account identifiers, credentials, contact details, or payment information; anything you include in the prompt text itself is transmitted.
United States
AI response generation used for visibility measurement (Gemini).
The text of each prompt you track, sent as written, which may include brand, product, and competitor names. We do not attach account identifiers, credentials, contact details, or payment information; anything you include in the prompt text itself is transmitted.
United States
AI response generation used for visibility measurement (Perplexity).
The text of each prompt you track, sent as written, which may include brand, product, and competitor names. We do not attach account identifiers, credentials, contact details, or payment information; anything you include in the prompt text itself is transmitted.
United States
The location shown for each subprocessor is the country in which it stores and processes the data we send it. Every subprocessor above stores and processes that data in the United States. One qualification applies: Vercel routes requests through a global edge network, so the request metadata of a visitor outside the United States is handled at the edge location nearest to them on its way to our servers. Where a transfer from the EEA, UK or Switzerland requires a safeguard, section 9 of the Data Processing Agreement sets out the mechanism we rely on.
Sending your prompts to these four companies is the core function of helloAISearch: we ask each engine the questions you choose to track, and record whether it mentions your brand. There is no way to use the Service without this transfer taking place, which is why we name the providers rather than describing them generically.
Each provider processes what it receives under its own privacy policy and its own terms. They receive the prompt text as you wrote it and nothing else: we do not attach your name, email address, account identifiers, billing details, or credentials. Anything you include in a prompt is sent with it, so do not put personal data or secrets in prompt text.
The free tools at helloaisearch.com/tools can be used without an account. They are served by the same subprocessors as the rest of the Service, and only those. A guest’s request metadata (IP address, browser information) is handled by Vercel and, for error reports, by Sentry, exactly as for any page on the site. Railway holds the rate-limit counter for each tool, keyed by a hashed IP address, for 24 hours.
When a free tool performs a live AI check, the brand name and question you enter are sent to Anthropic, PBC (Claude) and to no other AI provider, with the same generic system instruction we use for scans. A tool that shows a demo sample sends nothing to any AI provider, and each tool page says which of the two it does. No email address, IP address, or account information travels with a live check.
If you ask a free tool to email you a report, Supabase stores the email address, the tool used, the time of the request, and the report contents, and Resend delivers the message. Every such email carries an unsubscribe link. Free-tool guest inputs are not used to train our models, as section 3 of the Privacy Policy states.
Our own use of prompts and scan results to improve helloAISearch, including model training and benchmark development, is described in sections 3 and 5 of the Privacy Policy. You can exclude your account from that work at any time in Settings → Account → Data use. That choice does not change the list above, because the providers above are needed to operate the Service itself.
Our Data Processing Agreement sets out how we handle a change to this list, including the notice you receive and your right to object. If you have a question about a specific subprocessor, contact us at privacy@helloaisearch.com.