Subprocessors

Effective Date: April 25, 2026 Last Updated: April 25, 2026

About This Page

This page lists the third-party service providers ("Subprocessors") that Belisto LLC ("Belisto," "we," "us," or "our") engages to help deliver the Belisto Local Growth Platform and related managed services (the "Services").

A Subprocessor is a third party that processes personal data or client data on our behalf. We carefully select Subprocessors, vet their security and privacy practices, and contractually require them to maintain protections substantially equivalent to those we commit to you.

This page is maintained in accordance with our Data Processing Addendum and is updated whenever we add, remove, or replace a material Subprocessor.

How We Select Subprocessors

Before engaging a Subprocessor, we evaluate:

The necessity of the service for providing the Services to you
The Subprocessor's security, privacy, and compliance posture
The Subprocessor's industry reputation and stability
The geographic location of data processing and applicable data transfer requirements
The contractual commitments the Subprocessor is willing to make regarding data protection

All Subprocessors that process personal data on our behalf are contractually required to:

Process data only for the purposes we specify
Implement appropriate technical and organizational security measures
Maintain confidentiality of the data they process
Comply with applicable data protection laws
Notify us promptly of any security incidents affecting the data they process
Return or delete data when our relationship with them ends

Notification of Changes

We will notify clients of the addition or replacement of a Subprocessor by:

Updating this page with the new information
Where clients have subscribed to subprocessor notifications, sending an email notice
For material changes, providing at least 30 days' advance notice where reasonably practicable

Clients may object to a new Subprocessor for legitimate data protection reasons as described in our Data Processing Addendum.

To subscribe to subprocessor update notifications, email privacy@belisto.ai with "Subscribe — Subprocessor Updates" in the subject line.

Current Subprocessors

The following Subprocessors are currently engaged by Belisto. Categories are listed in order of the data sensitivity each Subprocessor typically handles.

Cloud Infrastructure and Hosting

Subprocessor	Purpose	Data Processing Location	Privacy/Security Information
Vercel, Inc.	Application hosting, deployment, and content delivery for the Belisto web application	United States	vercel.com/legal/privacy-policy
Supabase, Inc.	Managed database (PostgreSQL), authentication, and file storage	United States (default region)	supabase.com/privacy

Third-Party Platform Integrations

Subprocessor	Purpose	Data Processing Location	Privacy/Security Information
Google LLC	Google Business Profile, Google Search Console, Google Analytics, and related APIs used to provide Services on Client's behalf, under Client's authorization	United States and globally	policies.google.com/privacy
Firecrawl	Website crawling and content extraction for SEO audits	United States	https://belisto.ai/subprocessors

AI and Machine Learning Services

Subprocessor	Purpose	Data Processing Location	Privacy/Security Information
Anthropic, PBC	AI-assisted content drafting (posts, replies, page content), subject to commercial terms that prohibit use of client data to train models	United States	anthropic.com/legal/privacy

Payments

Subprocessor	Purpose	Data Processing Location	Privacy/Security Information
Stripe, Inc.	Payment processing, subscription billing, and fraud prevention	United States and globally	stripe.com/privacy

Communications

Subprocessor	Purpose	Data Processing Location	Privacy/Security Information
SendGrid	Transactional email, report delivery, and client communications	United States	https://belisto.ai/subprocessors

Monitoring, Analytics, and Support (as applicable)

Subprocessor	Purpose	Data Processing Location	Privacy/Security Information
Sentry	Application error monitoring and diagnostics	United States	https://belisto.ai/subprocessors
Datadog	Infrastructure and application performance monitoring	United States	https://belisto.ai/subprocessors
Fathom Analytics	Analytics for Belisto's own website (not for client data)	United States	https://belisto.ai/subprocessors

Professional Services

Belisto may also share data with legal, accounting, and tax advisors under customary professional-services confidentiality obligations. These advisors are not included in the table above but are subject to confidentiality and data protection obligations equivalent to those in this Subprocessor framework.

Restaurant-Client-Authorized Third Parties

Separate from the Subprocessors listed above, Belisto interacts with third-party platforms on each client's behalf, using access that the client has authorized. These third parties are not Subprocessors of Belisto; the client has its own direct relationship with each of them and has directly authorized Belisto to act on their behalf. Examples include:

Google Business Profile (via Google LLC)
Review platforms (Yelp, TripAdvisor, Facebook, and others the client has authorized)
The client's website content management system
The client's point-of-sale or ordering platform
Listings aggregators

Belisto's access to each of these platforms is governed by the client's authorization and by the platform's own terms of service and privacy policy, in addition to the commitments Belisto makes in its Privacy Policy and Data Processing Addendum.

Historical Changes

We maintain a record of changes to our Subprocessor list for transparency.

Date	Change	Subprocessor	Purpose
United States	Added	United States	United States

Questions

If you have questions about our Subprocessors, our vetting process, or our data protection practices, please contact us at:

Belisto LLC Attn: Privacy 2138 Statute Lane, Vienna, VA 22180 Email: privacy@belisto.ai

This page is provided for transparency and to support compliance with data protection laws. It does not modify or replace the commitments in the Privacy Policy, Terms of Service, or Data Processing Addendum.