Last Updated: 9/27/2026
The service providers below process data on our behalf to run Aviation Expert GPT. This list is maintained by our engineering team and is updated in the same change that adds or removes an integration. For how we handle personal data generally, see the Privacy Policy.
| Provider | Purpose | Personal data involved | Location |
|---|---|---|---|
| Vercel | Application hosting and serverless backend | Account and usage data passing through the application; server logs | United States / global edge network |
| Supabase | PostgreSQL database hosting | All account records and application data | United States (AWS us-east-2) |
| Stripe | Web payment processing | Name, email, payment details (card data never touches our servers) | United States |
| RevenueCat | Mobile subscription management (App Store / Google Play purchases) | App user ID, purchase and transaction history | United States |
| Cloudflare | User-file storage (R2), bot protection (Turnstile), edge network | Uploaded files; IP addresses | Global (Cloudflare network) |
| Hostinger | Transactional email (SMTP) and hosting for our self-managed automation server (n8n) | Email addresses and email content; chat content passing through the automation server | Provider-managed |
| xAI | AI chat responses (Grok models) | Chat message content and uploads (no name or email attached) | United States |
| Google (Gemini) | AI chat responses (Gemini models) | Chat message content and uploads (no name or email attached) | United States |
| DeepSeek | AI chat responses (DeepSeek models) | Chat message content and uploads (no name or email attached) | China |
| OpenAI | AI chat responses (ChatGPT models); retrieval embeddings | Chat, text and audio content (no name or email attached) | United States |
| Sentry (Functional Software) | Error monitoring and session replay | User ID, error context, masked replay data | United States |
| Upstash | API rate limiting | IP addresses (and the email being acted on, inside rate-limit keys) | Provider-managed |
| Google (Analytics / Ads) | Product analytics and ad conversion measurement | Usage data — Analytics only after you allow analytics cookies; Ads conversion measurement only after you allow marketing cookies | United States / global |
| PostHog | Product analytics (feature usage, funnels, performance) and AI Observability (quality monitoring of the Aviation Expert GPT assistant) | Usage data and the account's internal user ID — no name or email. Web capture only after you allow analytics cookies; if you decline, the browser sends nothing to PostHog. AI Observability additionally receives a record of each AI conversation turn — your message, the assistant's reply and the reference material it retrieved — linked to the account ID only, shortened before sending, and deleted when the account is deleted. | United States |
| Meta | Ad attribution (Meta Pixel) | Usage data — only after you allow marketing cookies | United States |
| Meta (Meta AI) | In-chat image generation, when you accept an image offer | The image description sent for generation (no name or email attached) | United States |
| CookieHub | Cookie-consent management (the cookie banner and proof of consent) | Your cookie choice, a consent ID, an anonymized IP address, browser details, the page URL, your country and a timestamp | Iceland (European Economic Area) |
The aviation-data and mapping providers we use — metar-taf.com, ADS-B Exchange (via RapidAPI), Flightradar24, openAIP, airportdb.io, Google Weather API, and map tile providers (OpenStreetMap, CARTO, ArcGIS) — receive only technical queries such as airport codes, coordinates, and aircraft identifiers. No personal data (name, email, account identity) is sent to them.
When we add a provider that will process personal data, we update this page before or alongside the launch of the feature that uses it. If you have questions about any provider on this list, contact us.
