Sub-processors

Last updated: 22 September 2026

A sub-processor is a third party we use to help run Pharos. This page lists every one of them, what they do, and where they're based. We keep this page current so you always know who is involved in processing your data.

If you have a Data Processing Agreement (DPA) with us, we'll notify you at least 30 days before we add a new sub-processor, unless the change is required for security reasons.

Core infrastructure

Analytics

AI traffic tracking

If you add Pharos's AI-traffic tracking to your website, we record visits from AI assistants and their crawlers. To show which country and city those visits come from, we may send the visitor's IP address to an IP-geolocation service when the request does not already carry a location. We store the resulting country and city, not the IP address itself (bot verification keeps only a one-way hash of it).

AI platforms (queried on your behalf)

These are the services Pharos uses to put your prompts to AI platforms and collect the answers that make up your brand-visibility data. What we send is the prompt text you set up in your dashboard (which includes the brand and competitor names you track), the language, and the country or city we ask the answer to reflect. We do not send your account details or any personal data about your customers.

How answers are collected. For ChatGPT, Gemini and Google AI Mode, we collect the answer the public consumer app gives a logged-out user, through a data-collection provider (DataForSEO, with Bright Data as a backup). If neither can return an answer, we ask the AI provider's own API instead. Claude and Perplexity answers come from their providers' APIs.

AI models that analyse your data and write content

Beyond collecting answers, Pharos uses AI models to work with your account data: to analyse the collected answers (mentions, sentiment, how your brand and competitors are framed, citations), to generate prompts, recommendations, insights, report summaries and content drafts, and to answer questions in the in-app assistant. What these models receive is your brand data (brand, competitor and topic names, prompts), the collected AI answers and the pages they cite, content you write or ask us to optimise (including text from your own website), and messages you send to the assistant. We do not send your account details or payment data.

Where we use an AI provider's API, we send traffic through zero-retention / no-training endpoints where the provider offers them, so your prompts aren't used to train its models. TypeSafe's terms commit it not to train or fine-tune models on what we send it. Answers collected from consumer apps are collected logged out, with no account of yours. If you have a specific compliance requirement, email privacy@heypharos.com.

International transfers

Our primary database (Supabase) and several other sub-processors are in the United States, and one (Bright Data) is in Israel, which the European Commission and the UK recognise as providing adequate protection for personal data. For other transfers we rely on:

• EU Standard Contractual Clauses (SCCs) approved by the European Commission for transfers from the EEA.
• UK International Data Transfer Addendum for transfers from the UK.
• Swiss data protection framework for transfers from Switzerland.

Change notifications

Enterprise customers with a signed DPA: we'll email your designated privacy contact at least 30 days before any new sub-processor is added, unless the addition is required to respond to a security incident.

Everyone else: this page is the authoritative list. Watch the "Last updated" date.

Contact

Questions: privacy@heypharos.com.

Adapted from Basecamp's open-source policies (CC BY 4.0).