This page lists the sub-processors used by Sponge Theory to deliver the Rayonne Services. It is updated upon any addition, removal or material change.
Hosting and infrastructure
| Subprocessor | Country | Purpose | Data |
|---|
| Sponge Theory Cluster (Docker Swarm + Portainer) | France | Application and database hosting | Account data, briefs, strategies, content, submissions, measurements |
| PostgreSQL (self-hosted) | France | Primary relational database | Same as above |
| MinIO (self-hosted) | France | Object storage (assets, evidence screenshots) | Logos, screenshots, exports |
| Redis (self-hosted) | France | Celery queue + cache | Transient technical data |
AI inference — sovereign
| Subprocessor | Country | Purpose | Data |
|---|
| SPT Models (Sponge Theory, self-hosted) | Sponge Theory’s own infrastructure | LLM, VLM and embeddings inference (models served by SPT Models) | Prompts, extracted content, generated content |
No data is transmitted to OpenAI, Anthropic, Mistral, Google (Gemini), Groq, Cohere, Perplexity or any other external AI provider. This sovereignty is an irrevocable architecture decision; it is technically verifiable in the inference call source code.
Authentication and identity
| Subprocessor | Country | Purpose | Data |
|---|
| Clerk (Clerk, Inc.) | USA (EU-U.S. DPF certified) | Authentication, account and organisation management | E-mail, first name, last name, OAuth identifiers |
Payment
| Subprocessor | Country | Purpose | Data |
|---|
| Stripe (Stripe Payments Europe Ltd.) | Ireland | Payment processing, subscription management, invoices | Customer ID, subscription type, amount, payment method (never the card number on Rayonne side) |
Transactional e-mail
| Subprocessor | Country | Purpose | Data |
|---|
| Resend (Resend, Inc.) | USA (EU-U.S. DPF certified) | Confirmation e-mails, alerts, product notifications | E-mail, first name, e-mail body |
Observability
| Subprocessor | Country | Purpose | Data |
|---|
| Sentry (self-hosted on Sponge Theory cluster) | France | Error logs and performance traces | Anonymised stack traces (e-mail redacted) |
Sponge Theory partner services
| Subprocessor | Country | Purpose | Data |
|---|
| Audigeo (Sponge Theory) | Sponge Theory’s own infrastructure | GEO audit at each product analysis (and each time the User re-runs it); on the Pro plan and above, a full GEO audit every month and a weekly reading of AI assistants’ answers. Asks public AI assistants the questions of the User’s market | Product’s public URL; the product’s name, category, competitors and problems in the questions asked, and questions the User adds; AI visibility metrics |
| NeoRAG (Sponge Theory) | Sponge Theory’s own infrastructure | Per-workspace knowledge base | Documents indexed per workspace |
Publishing platforms (recipients, on the User's instruction)
These services are not Rayonne subprocessors: on the User's explicit instruction they receive the content the User chose to publish there, and process it under their own terms.
| Recipient | Country | Purpose | Data |
|---|
| YouTube (Google LLC) — YouTube API Services | USA (EU-U.S. DPF certified) | Uploading videos to the User's channel on their instruction (youtube.upload scope only) | Video, title, description, tags, visibility; OAuth token encrypted on Rayonne's side — see Privacy Policy §4.1 and the Google Privacy Policy |
| TikTok (TikTok Technology Ltd.) — Content Posting API | Ireland | Uploading videos to the User's account on their instruction | Video, title, AI-generated-content disclosure; OAuth token encrypted on Rayonne's side |
| LinkedIn, X | Ireland / USA | Publishing content to the User's account on their instruction | Published content; OAuth token encrypted on Rayonne's side |
Changes
Any material change (new sub-processor, country change, data category change) is notified by e-mail at least 30 days before it takes effect. The User may object by terminating their subscription before the effective date, without penalty.
Contact
contact@sponge-theory.ai
© Sponge Theory. All rights reserved.