Sub-processor List
Version: 2026-08-23
Last Updated: August 23, 2026
This page is the authoritative list of third parties Ploy, Inc. engages to process personal data on behalf of customers when providing the hosted Ploy Service. It is referenced by our Privacy Policy and any applicable data processing addendum.
A sub-processor receives only the information reasonably necessary for the purpose described below. We require sub-processors to protect the data they process through written data-protection and confidentiality terms. Not every sub-processor receives data from every customer; some apply only when you use a particular feature.
1. Sub-processors
| Sub-processor | Purpose | Data processed | Primary processing location |
|---|---|---|---|
| LLM Gateway / Polar Lights LLC | AI gateway, model routing, and inference | AI prompts, inputs, context, generated outputs, model selection, and request metadata such as token usage, latency, and cost | European Union, United States, and locations used by the model provider serving the request |
| GitHub, Inc. | Authentication, source repository integration, webhooks, and software distribution | Name, username, email, account identifiers, repository metadata, source code, and commit information you authorize Ploy to access | United States and other locations described by GitHub |
| Stripe, Inc. | Payment, subscription, invoice, tax, and fraud processing | Name, email, billing address, company and tax information, payment-method details, subscription status, and transaction history | United States, European Union, and other locations described by Stripe |
| PostHog, Inc. | Product analytics, website analytics, and feature measurement | Account identifiers, email, IP address, browser and device data, page views, clicks, product events, and usage patterns | United States |
| Brevo / Sendinblue SAS | Contact management and permitted product or marketing email | Name, email address, contact status, list membership, and email engagement information | European Union and other locations described by Brevo |
We do not engage sub-processors to sell personal information or for cross-context behavioral advertising.
2. LLM Gateway and AI Providers
LLM Gateway processes data only when you or a Ploy feature makes an AI request. It routes the request to a model provider capable of serving the selected model. Those providers are part of LLM Gateway's own sub-processor chain; Ploy does not maintain a separate provider catalogue.
Model providers may differ in retention, training, geographic location, and security and compliance posture. Do not send personal, regulated, or sensitive information through AI features unless your organization has confirmed that the selected model and available safeguards are suitable. For current details, review LLM Gateway's Privacy Policy and Sub-processor List.
3. Customer-Directed and Self-Hosted Services
This list does not include services that you connect to Ploy using your own account or credentials, or providers you select for a self-hosted Ploy installation. In those cases, you engage and configure the provider directly and are responsible for its terms and data practices.
4. Changes to This List
We may update this list as the Service changes. Where required by an applicable agreement or data-protection law, we will give customers at least 30 days' notice before a new sub-processor begins processing Customer Data. Notice may be provided by email, through the Service, or by updating this page.
If you object to a new sub-processor on reasonable data-protection grounds, email us during the notice period. We will work with you in good faith to provide a commercially reasonable alternative where feasible. If no alternative is available, you may stop using the affected feature or terminate the affected Service subject to your agreement with us.
5. International Transfers
Sub-processors may process personal data outside the EEA, Switzerland, or the UK. Where required, we use appropriate safeguards such as an adequacy decision, Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful transfer mechanism. For AI requests, the transfer location and safeguard may also depend on LLM Gateway's downstream model provider.
6. Contact
For questions about this list, data processing terms, or a sub-processor objection, email contact@meetploy.com.