Subprocessors
Last updated September 10, 2026 · version 2026-09-10
These companies process data on our behalf so Galaxy Unit can run. Each is bound by its own data processing terms, processes only what its job needs, and does not use your data for itself. We do not sell your data to anyone.
Inside the product
| Provider | What for | Where | What it sees |
|---|---|---|---|
| Supabase | Database, sign-in, file storage | United States (us-east-1) | Everything in your workspace: accounts, your customers, jobs, quotes, invoices, payments, expenses, photos, receipts, logs. |
| Vercel | Runs the application and the website; scheduled jobs | United States (Washington, D.C. area) | Request data in transit: IP address, browser, pages requested. Aggregate, cookieless page counts. |
| Anthropic | AI provider for Copilot text and photos | United States | Your question, the conversation, the workspace records the assistant reads to answer, photos you attach. |
| OpenAI | AI provider for voice and speech; optional text provider | United States | Live microphone audio (browser to provider, not via us); text to be spoken; the same as Anthropic when chosen as the text provider. |
| Resend | Sends and receives e-mail | United States | Recipient address, subject and body of sign-in links, invitations, support replies, invoices and quotes you send, reports. |
Data is stored and processed in the United States. We do not promise Canada-only storage. If you store your own AI provider key in settings, your AI requests go to your own account with that provider rather than ours. Our AI providers do not train their models on what we send them; the details are in the AI & Data Use Notice.
On the public website only, with your consent
- Google Tag Manager, Google Analytics, Google Ads — Website analytics and ad measurement — only after you accept that group on the cookie banner.
- Microsoft Clarity — Heatmaps and anonymised session recordings of the website — only after you accept analytics.
- Meta (Facebook, Instagram) — Ad measurement pixel on the website — only after you accept marketing.
None of these run inside the product, and none run on the website until you accept the matching group. See the Cookie Notice.
Your own website, if you connect it
If you install our WordPress plugin on your website, form submissions and visit counts flow from your host to your Galaxy Unit workspace. That is your site and your visitors; we are the processor for you there, and the plugin records your acceptance when you connect it.
When this list changes
Adding or replacing a provider updates this page before the change goes live, and we tell account owners in the product. If you object to a new provider, you may export your data and close your account before the change takes effect.