Sub-processors

Everyone who processes data on our behalf. We give 30 days' notice before this list changes, so you have time to object.

Outside the EU

xAI sees a screenshot and a truncated source for the few versions our own checks cannot decide — roughly three to five in a hundred. It never sees an account, an email, or anything identifying.

Anthropic receives what you write when you use Describe it, and, for the free changes after it, the site's code and what you ask for, so its model can build the site. It is sent on Solta's own account, never with your email, and Anthropic does not train its models on it. It is only used when you ask Solta to build something: nothing you paste, upload or publish otherwise goes there (see the privacy policy).

Google receives URLs to check against its list of known-bad sites. That is the whole request.

Stripe processes payments from Ireland and the United States.

Slack (Slack Technologies, a Salesforce company) carries our internal notifications to the Solta team: a new account, a billing event, an error, a report about a site. It sees the account's email and name, the workspace's name and the plan, and for a report what the reporter wrote and their email, when they gave one. For the growth notices it also sees how an account signed up, whether it has published yet and whether it connected Claude or ChatGPT, a site's title, address and visitor numbers, and the domains of the pages a site is embedded on, never the account's email. When a site's owner reports a problem with it, Slack sees the site's title and address, which version it was, the plan, what they wrote and their browser's user agent, and again never the account's email. The same goes for a message to support: Slack sees what it is about and what they wrote, the account's internal identifier, the plan, the workspace and site if they named one, and their browser's user agent. Never the account's email, and never a screenshot: Slack gets a link to it that only our staff can open.

DataFast (JustShipIt Pte. Ltd., a company under Singapore law) counts visits to solta.now's own pages — the home page, pricing, the docs and the like — for visitors who said yes when asked, and the moments our servers add to those visits, with the account's internal identifier; we send it no name or email. Most of its infrastructure is outside the EU, including in the United States, and it relies on its own sub-processors' standard contractual clauses. It never runs on a published site, a customer's domain or an embed; a link from a site on its owner's own domain to solta.now can show up there as where a visitor came from. What it sees is set out in the privacy policy.

They are disclosed because they are the exceptions to “EU by default”, not because the plan changed.

Services you choose to connect

Not our sub-processors: you have your own account with them, and we pass on what you send because you asked us to.

OpenRouter (United States), when a site lets visitors bring their own AI and you connect yours: what you type on that site goes to OpenRouter, and through it to the model it routes to, under your own OpenRouter account. What we keep, and for how long, is in the privacy policy.

The model provider a site’s owner chooses for their own key, such as Anthropic or OpenAI, is the same: the owner’s account, not ours. (Describe it, above, is the one use of Anthropic on Solta’s own account.)

So are a Slack channel or a webhook a site’s owner connects on Pro: their workspace or their server, told what they chose. That can include a form’s field names, and a comment with the commenter’s name, never an email address.

Being told

Write to legal@solta.now to be notified when this list changes.