Draft, not legal advice. This page is a starting-point template, written to match webma's actual features — it has not been reviewed by a lawyer. Have qualified legal counsel review and adapt it (especially for your specific jurisdictions, tax setup, and any Paddle merchant-of-record terms) before relying on it for a real launch.
Subprocessors
Last updated: September 2026
These are the third-party services webma relies on to operate, and what each one sees. See our Privacy Policy for how we use this data overall, and our AI use disclosure for more detail on the AI providers specifically.
| Subprocessor | Purpose | Data shared | Location |
|---|---|---|---|
| Supabase | Database, authentication, file storage | Account data, generated site content, usage/credit records | US (or your project's configured region) |
| Anthropic | AI: full website generation, complex edits | Your website description and edit instructions | US |
| Groq | AI: lightweight edits, follow-up questions, voice transcription (Whisper) | Edit instructions; voice recordings for transcription only, not stored | US |
| Cerebras | AI: lightweight edits (fallback if Groq is unavailable) | Edit instructions | US |
| OpenRouter | AI: lightweight edits (fallback if Groq and Cerebras are unavailable) | Edit instructions | Routes to various underlying model providers |
| OpenAI | AI image generation | Your image generation prompt | US |
| Paddle | Payment processing and merchant of record | Billing details, purchase history | UK/EU/US depending on your region |
| Vercel | Application hosting; deployment target for sites you publish | Application traffic; your site's code, if you deploy through us | Global CDN |
| Resend | Transactional email delivery | Your email address, name, and the email's content | US |
| Upstash | Rate limiting (production, multi-instance deployments) | Hashed identifiers used as rate-limit keys — no personal content | Configurable region |
| Sentry | Error tracking (only if configured) | Error reports, which may include request context | US/EU depending on your project |
Several of these are optional and only active if configured for a given deployment (e.g. Sentry, Upstash) — see this project's own .env.example for exactly which environment variables enable each one.
Changes to this list
We'll update this page when we add or remove a subprocessor. Material changes will be communicated before they take effect, consistent with our Privacy Policy.