ComprehendlySub-processor list — Comprehendly
Provider: UltraDigital Limited (“StepCare”, “Comprehendly”, “we”, “us”)
Effective date: 1 August 2026
Version: 1.2
This list is incorporated by reference into the Privacy Policy and Data Processing Agreement. We will update this page when we add or replace sub-processors and will provide notice as required under your agreement (generally at least 14 days before engagement of a new sub-processor for Customer Personal Data).
Comprehendly is a StepCare product operated by UltraDigital Limited. Privacy and security contacts use StepCare addresses (privacy@stepcare.app, security@stepcare.app) for the whole product family.
Definitions
Sub-processor means a third party engaged by UltraDigital Limited to process personal information on our behalf in connection with Comprehendly.
Sub-processors
| Sub-processor | Processing activity | Typical data categories | Typical location |
|---|---|---|---|
| Supabase, Inc. | Authentication, application database, file storage, Edge Functions | Account, tenant, form submissions, voice session metadata, audit logs, integration logs | Frankfurt (EU) and Sydney (Australia) |
| Vercel Inc. | Web application, marketing site, and embed SDK hosting | Technical logs, IP address, request metadata | Global CDN, including United States |
| OpenAI, LLC (or affiliate) | Speech-to-text and language-model processing for form assistance | Live voice audio streams, optional transcripts, form field labels/values in prompts | United States — customer content not used for model training (contractual) |
| Twilio Inc. | Phone call delivery and OTP for form completion / demos | Phone numbers, SMS content, call metadata, live call audio | Twilio global network — call recording storage disabled |
| Stripe, Inc. | Subscription and one-time payments, billing portal | Name, email, billing address, payment method tokens, invoice metadata | United States; local Stripe entities may apply |
| Resend | Transactional email | Email address, message content/metadata | United States |
| Firebase Cloud Messaging (Google) | Mobile push notifications | Device tokens, user identifiers | Global |
| Google LLC | OAuth sign-in; optional Calendar booking on marketing site; Google Analytics | Account identifier, email, profile basics; booking details; analytics events | Global |
| Cloudflare, Inc. | Turnstile bot protection on public marketing demos | IP address, browser/device signals for challenge | United States / global edge |
| Capgo | Native app over-the-air updates | Device/app update metadata | As configured by Capgo |
| CookieYes | Cookie consent management | Consent preferences, device identifiers | As configured by CookieYes |
| Sentry | Error monitoring | Error reports, device/browser metadata; may include limited request context | As configured |
| GitHub, Inc. | Source control and CI/CD | Source code, CI logs (not Customer form content in normal operation) | United States |
Customer responsibilities
Where you enable optional integrations or enter personal information into fields beyond what Comprehendly requires, you remain responsible for lawful collection and for any additional processors you appoint.
Objections
Enterprise customers may object to a new sub-processor as described in the DPA. Contact: privacy@stepcare.app (Comprehendly is a StepCare product).
Change log
| Version | Date | Change |
|---|---|---|
| 1.0 | 1 August 2026 | Initial published list |
| 1.1 | 1 August 2026 | Confirmed Frankfurt/Sydney; OpenAI no-training; Twilio recording off; Resend + FCM; removed PostHog |
| 1.2 | 1 August 2026 | Unified sub-processor table (Sentry, CookieYes, Google Analytics listed without status labels) |
End of Sub-processor list