The Panel.

Who touches your data

Every provider that processes personal data or your material for The Panel, what it receives, and where it runs.

Last updated: 19 September 2026

This is the current list referred to in Section 5 of the Privacy Notice.

In brief

Your account is stored in the European Union. The AI, crawling, speech, email and hosting providers process data in the United States or on global infrastructure, under the safeguards in Section 6 of the Privacy Notice. Each one receives only what its role needs, and none of them is given your material for advertising or to train models. We do not sell personal data.

Providers

  • Neon

    European Union (Frankfurt)

    Account database and the sign-in system (Neon Auth). Where your account lives.

    Receives: Your email address, account identifier and sign-in session records, including IP address and browser details.

  • Resend

    United States

    Delivers the one-time login code emails.

    Receives: Your email address and the login email itself.

  • Vercel

    United States and global infrastructure

    Hosts facethepanel.com and runs the server code for each session.

    Receives: Every request to the site, so your IP address, browser details and, in transit and in memory only, the material you submit. Keeps standard request logs.

  • Upstash

    Global infrastructure

    Holds the counters that limit how many sessions can be started in an hour and a day.

    Receives: Your IP address as part of a counter name, and a count. Counters expire within 24 hours.

  • OpenAI

    United States

    Language model that writes the persona reviews and the coordinator steps (research summary, briefs, final report) in the product review.

    Receives: The material for the session: your description, crawled page text, the site screenshot and web research. Not your email address or account identifier.

    Called through the business API, which by default does not train on API data. Requests are sent with response storage turned off; OpenAI may keep abuse-monitoring logs for up to 30 days.

  • Anthropic

    United States

    Language models for the Pitch Room, for describing uploaded screenshots and PDF decks, for deriving search queries from an idea, and as the fallback writer in the product review.

    Receives: The material for the session: your pitch or description, uploaded screenshots and deck, crawled page text and web research. Not your email address or account identifier.

    Commercial API terms do not permit training on our data. Inputs and outputs are deleted within 30 days unless flagged under Anthropic's usage policies or retention is required by law.

  • TypeSafe

    See the provider's terms

    Estimates which personas fall within a product's audience, to help cast the panel.

    Receives: A short glimpse of the product only: its title, description and the opening of the page or brief.

  • Firecrawl

    United States

    Fetches the public pages of a submitted website, takes the screenshot, and runs the web searches for competitors.

    Receives: The website address you submit and search queries derived from your product. It hosts the screenshot it takes for a limited time.

  • ElevenLabs

    United States

    Speech-to-text for dictating a pitch. Used only if you press the microphone button.

    Receives: The audio recording you dictate, which may include the voice of anyone else speaking nearby. We do not keep the recording; the transcript goes back to your browser.

Changes to this list

If a provider is not listed above, it does not process personal data or your material for The Panel. When we add or change a provider we update this page first, before the provider begins processing, and where the change is material we tell you at sign-in or by email. Questions? Email hello@facethepanel.com.