RivalGauge
Subprocessors
Everyone we rely on to run the service, what each is for, and what each actually sees. This is the list referenced by the data processing addendum.
The current list
RivalGauge is operated by Safe Haven Ventures LLC, a Colorado limited liability company. The parties below process customer data on our instructions in order to provide the service.
| Subprocessor | What it is for | What it sees | Where |
|---|---|---|---|
| Cloudflare, Inc. | Hosting, the application platform, the database, object storage for uploaded logos, and the CDN for this website | All service data at rest and in transit, including lead records | United States, with edge processing in the region nearest the request |
| Stripe, Inc. | Checkout, subscriptions, invoices and payment | Account email, company name, and payment details entered on Stripe’s own hosted page | United States |
| Resend (Plus Five Five, Inc.) | Sending report emails, lead notifications, account email and sign-in links | Recipient address, sender identity, and the rendered contents of the message | United States |
| Google LLC | Places business listings and PageSpeed performance measurements used to build a report | The scanned domain and the trade and city submitted with it. No lead identity is sent | United States |
| Ahrefs Pte. Ltd. | Domain Rating figures used to build a report | The scanned domain only | Singapore |
| OpenRouter, Inc., and the model providers it routes to | The AI visibility check, which asks several models who they would recommend | The trade and city only. Neither the lead’s identity nor the scanned domain is sent | United States |
What each one sees
The scan data sources are narrower than people expect, and the table above states it exactly. A scan sends the domain to Ahrefs and Google, and the trade and city to the AI models. It does not send the lead's name, the lead's email address, or anything else about the person who filled in your widget. Those stay with us, with you, and with whatever webhook endpoint you configured.
We add a subprocessor only when a feature needs one. Each processes data under its own terms and its own security commitments, and we do not authorise any of them to use customer data for their own purposes.
Lead data also reaches two places that are not subprocessors, because they are you: the dashboard for your account, and any webhook endpoint or CRM you point us at. That is the product working as designed rather than a disclosure, and you are the controller of that data throughout.
Notice of changes
Before a new subprocessor starts handling customer data, this page is updated and the change is emailed to active accounts. If you object to a new subprocessor on reasonable data protection grounds, you may cancel before it takes effect and we will refund the unused remainder of any period you have paid for. That is a deliberate exception to the ordinary refund policy, because a change we make should not cost you money.
The date at the top of this page changes whenever the list does.
Questions
Write to support@rivalgauge.com. Data protection questions, including requests under the data processing addendum, go to the same address and reach a person rather than a queue.