Candor, operated by Highline Beta Inc., uses the third-party service providers listed below ("subprocessors") to deliver the product. Each receives only the data it needs to perform its function.
We commit to providing existing customers at least 30 days’ email notice before adding a new subprocessor that would process their data. Customers may object within that window as described in our Data Processing Agreement. Questions: ben@highlinebeta.com.
Current subprocessors
| Service | Purpose | Data processed | Location | Legal entity |
|---|---|---|---|---|
| Supabase | Database, authentication, storage | All workspace content, account information, usage logs | United States (AWS us-west-2, Oregon) | Supabase, Inc. |
| Vercel | Application hosting, serverless compute | Request metadata, IP addresses, app logs | United States (application runs in AWS us-west-2, Oregon) | Vercel Inc. |
| Anthropic | Large-language-model inference (Claude) | Prompts and responses for synthetic participant generation and interview simulation | United States | Anthropic, PBC |
| Voyage AI | Embedding generation for document and research search | Text submitted for embedding: chunks of uploaded documents, and research text extracted from them and from interviews (short insights and supporting quotes). Deleted by Voyage as soon as it has been processed; never used for training. | United States | Voyage AI Innovations, Inc. |
| Tavily | Web search for research evidence retrieval | Industry and region search queries (no personal data) | United States | Tavily AI, Inc. |
| TypeSafe | Small judgements at five points in a study. While you set up a study, whether what you wrote about the audience disagrees with the age, role or region you entered. During audience research, whether the evidence already gathered answers a planned research question. During simulated interviews, judgements on the interviewer's questions, the synthetic participant's answers, and changes in a participant's stated opinions. After a concept test, which of the options a participant chose as their final pick. After a value proposition or messaging test, how each option landed with a participant: misread, understood but not believed, believed, or compelling | While you set up a study, what you wrote about the audience (its short and full descriptions, what you already know, and the groups to leave out) with the age, role, region, company size and income you entered. During audience research, the research questions Candor planned for your study and the findings it retrieved by web search, each a written insight with a topic tag. During simulated interviews, transcript excerpts: the current question and answer, recent earlier turns, and short summaries of the interview sections already covered. Also a participant's recorded changes of opinion on the topic being checked. When reading a final pick, the names and shortened descriptions of the options you are testing, with the closing questions and answers of that interview. When grading a value proposition or messaging option, the name and description of the product being tested, the option's statement, and the participant's answers about that option. Never uploaded documents or account information. Not used to train models. TypeSafe sets no fixed deletion period, and may keep and use information derived from this text, such as statistics and classifications. | United States | TypeSafe AI, Inc. |
| Inngest | Background job orchestration | Inputs and saved step results of background jobs, which can include any account, workspace or waitlist data a job handles: for example uploaded document text, interview transcripts, reports, billing details, data export links, and waitlist sign-ups with what our lookup finds about them (such as a name, profile picture and LinkedIn search results) | United States | Inngest, Inc. |
| Resend | Transactional email delivery | Email addresses, subject lines, message bodies | United States | Resend, Inc. |
| Mailchimp | Email list for factual product and account updates to every Candor account holder, and for marketing email to people who ask for it, by ticking the box on the sign-up form or invitation page or using the newsletter box on the website | Email address, and first and last name when given at sign-up or when accepting an invitation. No workspace content. | United States | The Rocket Science Group LLC (Intuit Mailchimp) |
| OAuth sign-in (optional, when a user chooses Google) | Email address, display name, profile image URL | United States | Google LLC | |
| Stripe | Subscription billing and payment processing | Workspace name, billing email address, workspace ID, and subscription and invoice records. Card details are entered on Stripe's own checkout page and never pass through Candor. | United States | Stripe, Inc. |
| Sentry | Error monitoring for the application | Error reports: the error message, where in the code it happened, and browser and device type. No name, email address or user ID is attached. Request bodies, query strings, cookies and sign-in headers are removed before a report leaves the app, so uploaded documents, prompts and transcripts are never sent. | United States | Functional Software, Inc. (Sentry) |
| Cloudflare Turnstile | Bot check on the sign-up form | IP address, browser user agent, and browser signals the check reads to tell a person from a bot. Only on the sign-up page. No account information and no workspace content. | United States | Cloudflare, Inc. |
| Slack | Internal alerts to the Candor team | A new account's email address and sign-in method; the workspace name and owner's email address on billing events; the project name and status when a study finishes or fails; summaries of application errors. No uploaded documents, transcripts or reports. | United States | Slack Technologies, LLC |
| Apify | Public web search to enrich waitlist email addresses with publicly available professional information | Waitlist email addresses (used as search queries), publicly available search results | United States / European Union | Apify Technologies s.r.o. |
| Gravatar (Automattic) | Public avatar and display-name lookup for waitlist email addresses | MD5 hash of the waitlist email address (sent as the lookup key) | United States | Automattic Inc. |
| Google Analytics | Aggregate visitor analytics on public marketing pages only (not loaded on the authenticated application). Sets no cookie and cannot identify a visitor until they have accepted analytics cookies on the consent banner. | IP address (truncated), user agent, referrer, page-view events, anonymous client identifier | United States | Google LLC |
| Fullstory | Product analytics and session replay inside the signed-in application, to find where the product is confusing or broken | Page views, clicks, scrolling and navigation paths, and a session replay that reproduces the screen as it appeared, so workspace content visible on the page is visible in the recording. Text typed into a field is masked before it leaves the browser; passwords and payment details are never captured; profile photos and two-factor setup codes are excluded. Account identifiers (user ID, workspace ID, role, plan), plus the workspace name where one has been set — no personal name, no email address. Runs only for someone who has accepted analytics cookies on the consent banner, and stops when that consent is withdrawn. Not loaded on public marketing pages or the admin console, and switched off while support staff are viewing an account on a customer's behalf. Recordings expire on Fullstory's retention schedule and are deleted on request; account deletion in Candor does not remove them automatically. | United States | Fullstory, Inc. |
| Calendly | The scheduling calendar shown on the Book a Demo page, for booking a demo with us. Not loaded anywhere in the signed-in application. | IP address and browser user agent, as with any request to a server; the cookies their embed sets, one of which is an anonymous identifier lasting a year; and whatever the visitor enters to book, which is their name, email address and any note they add. No account information and no workspace content. Loaded only for a visitor who has accepted functional cookies on the consent banner, so a visitor who declines sends them nothing. | United States. Certified under the EU-U.S. Data Privacy Framework, its UK Extension, and the Swiss-U.S. Data Privacy Framework. | Calendly, LLC |
| CookieYes | Cookie consent banner on every page, and the record of who consented to what and when | IP address and browser user agent, as with any request to a server; the consent choice, the time it was made, and a consent identifier stored in the visitor's browser. No account information and no workspace content. | Ireland (Amazon Web Services), inside the European Union. CookieYes Limited is a United Kingdom company. | CookieYes Limited |
Infrastructure (Candor-owned)
In addition to the vendors above, Candor processes data internally using its own application code running on Vercel (hosting) and Supabase (database + storage). No additional third-party processor touches customer data outside the list above.
Recent changes
- October 7, 2026: Added where CookieYes stores its data. CookieYes confirmed that its app and the consent records it keeps are hosted on Amazon Web Services in Ireland. CookieYes itself has not changed.
- October 7, 2026: Mailchimp now receives the email address of every Candor account holder, for factual product and account updates, instead of only the owners and admins of a paying workspace. Marketing email still goes only to people who ask for it. Never workspace content.
- October 6, 2026: Corrected what Inngest receives. It stores job inputs and the saved results of each job step, which can include any account, workspace or waitlist data a job handles, including what our waitlist lookup finds about a sign-up, not only IDs. Inngest itself has not changed.
- October 2, 2026: Mailchimp now also receives the email address of the owners and admins of a workspace that pays for Candor, unless they have already unsubscribed. No names and never workspace content.
- October 1, 2026: Added Mailchimp, which holds our marketing email list. It receives the email address, and the first and last name given at sign-up, of people who ask for Candor news. Deleting your Candor account unsubscribes you. Never workspace content.
- September 30, 2026: Corrected this list. Supabase and Vercel are in AWS us-west-2 (Oregon), not us-east-1 as previously stated. Added four services Candor already used but had left off: Stripe (billing), Sentry (error monitoring), Cloudflare Turnstile (the bot check on sign-up) and Slack (internal alerts to the Candor team).
- September 30, 2026: TypeSafe now also checks a study’s setup answers while you create it, so the review step can point out a box that disagrees with what you wrote. For this it receives what you wrote about the audience and the age, role, region, company size and income you entered. Never uploaded documents or account information.
- September 29, 2026: TypeSafe now also grades how each option landed in a value proposition or messaging test, choosing one answer from a short list rather than yes or no. For this it receives the name and description of the product being tested, each option’s statement, and the participant’s answers about that option. Never uploaded documents or account information.
- September 24, 2026: Added TypeSafe, which runs yes-or-no judgements during audience research, during simulated interviews, and when reading which option a participant picked in a concept test. It receives the research questions and web-search findings for a study, excerpts of interview transcripts, and the names and shortened descriptions of the options being tested. Never uploaded documents or account information.
- September 23, 2026 — Added Calendly, whose scheduling calendar is shown on the Book a Demo page. It was already there and already setting its own cookies; what changed is that it now waits for consent. Until a visitor accepts functional cookies the calendar does not load and Calendly receives nothing, and that visitor is given a link to Calendly’s own site and an email address instead.
- September 12, 2026 — Added CookieYes, which runs the cookie consent banner on every page and keeps the record of each consent. It receives the visitor’s IP address and browser user agent, the choice they made, and when they made it. Analytics and session replay now wait for that choice: until a visitor agrees, nothing is stored in their browser and the session replay does not run at all.
- September 10, 2026 — Added Fullstory for product analytics and session replay inside the signed-in application. Replays reproduce the screen as it appeared, so workspace content on the page is visible in them; text typed into a field is masked, and passwords and payment details are never captured. Fullstory is not loaded on public marketing pages or the admin console.
- May 11, 2026 — Added Apify and Gravatar (Automattic) for waitlist email enrichment using publicly available data. Neither processes authenticated-application data.
- May 11, 2026 — Added Google Analytics for aggregate visitor analytics on public marketing pages. Not loaded on the authenticated application.
- April 15, 2026 — Initial publication. Current list: Supabase, Vercel, Anthropic, Voyage AI, Tavily, Inngest, Resend, Google (OAuth only).
For questions about this list, or to request a countersigned copy of our Data Processing Agreement, email ben@highlinebeta.com.