CerebrOS Subprocessor List
Effective October 20, 2026
Version: 1
This page lists the companies that process personal information for CerebrOS when we provide the Service to event organizers ("Operators"). Under the Operator Terms (§10.5), each one is bound by a written contract at least as protective as the Operator Terms, and we remain responsible for their performance.
A row whose status reads "Live when …" processes data only once that feature is turned on.
We give Operators at least 14 days' notice, by email and in the Console, before a new or replacement subprocessor processes Operator Data. An Operator may object on reasonable data-protection grounds within that period.
Subprocessors
| Subprocessor | What it does for us | Personal information involved | Where | Status |
|---|---|---|---|---|
| Stripe, Inc. | Payment processing on each Operator's own Stripe account (direct charges); refunds; disputes; Add-On billing to Operators | Buyer name, email, ZIP, card details (entered directly into Stripe; never reach CerebrOS), amounts, device data for fraud checks; Operator billing contact and payment method | United States | Live |
| Vercel Inc. | Hosting, serverless functions, request logs, file storage (Vercel Blob), scheduled jobs | All information passing through the Service while it is served; uploaded event images; request logs with IP addresses | United States (functions run in Portland, Oregon, pdx1). Requests reach Vercel through its nearest network edge location before they are passed to Portland. | Live |
| Neon Inc. (a Databricks company) | Postgres database | All stored Service data, including buyer, order, ticket, check-in, consent and message records | United States (Oregon, us-west-2) | Live |
| Clerk, Inc. | Console sign-in and account security. Buyers never use Clerk. | Console users' names, emails, sign-in method, credentials, session data | United States | Live |
| Resend (Plus Five Five, Inc.) | Sending email: tickets, receipts, refund notices, agreement copies, and marketing email the Operator approves | Email address, name, order and ticket details, message content, delivery and unsubscribe status | United States | Live |
| Twilio Inc. | Sending and receiving text messages; carrier (10DLC) registration of each Operator's business | Mobile number, message content, delivery status, STOP/HELP replies; Operator business and tax details for registration | United States | Live when the text messaging Add-On is enabled and the Operator's texting number is approved |
| Apple Inc. (Apple Push Notification service) | Delivering Apple Wallet pass updates to a buyer's device | Device push tokens and pass serial numbers. Apple does not receive the pass contents from us through APNs. | Apple does not publish where APNs processes data | Live when Wallet passes are enabled |
| OpenRouter, Inc. and the AI model providers it selects | Answering Console users' plain-language questions about their own Organization's events | The Console user's question and the results of read-only queries: aggregates, event names, ZIP codes with counts, and at most a few guest names shortened to first name and last initial. Never buyer email addresses or phone numbers, street addresses, ticket codes, order or payment identifiers, or card data. Requests are routed only to providers that do not store prompts or train on them. | United States (OpenRouter). OpenRouter chooses the model provider for each request, and that provider may process it in another country. | Live when enabled |
| Google LLC (Google Maps Platform, Places API) | Address suggestions when a Console user types an event venue or business address. Buyer pages do not use it. | The typed address text, and the Console user's browser information (such as IP address) when the address script loads | United States and other countries where Google operates | Live when enabled |
What is not on this list
- Advertising services (Meta, Google Ads, TikTok and others). CerebrOS does not send any buyer information to an advertising service. CerebrOS Connect is not live.
- Analytics or tracking services. We do not use any. Our public site keeps its own anonymous page counts, with no cookies and no IP addresses (Privacy Policy §3.3).
- Google Fonts. Our pages and emails load typefaces from Google's servers, so a browser or email program that opens them sends Google its IP address and browser information. We send Google nothing else, and Google Fonts sets no cookies.
- Data brokers. We do not buy or sell data.
Changes
| Date | Change |
|---|---|
| October 20, 2026 | First published list |