Draft, not yet in effect. This policy is awaiting legal review and may change before launch.
Subprocessors
DRAFT. Requires attorney review. Not legal advice. Host and email provider chosen 2026-10-29; error monitoring not chosen yet.
| Subprocessor | Purpose | Data | Location | Status |
|---|---|---|---|---|
| Stripe | Payment processing for prepaid credit | Billing email, workspace ID, payment amounts. Card data is collected by Stripe directly. | [per Stripe's terms] | Integrated; account active, live billing not switched on |
| Render | Application, worker, database, file storage | All Service data | United States (Oregon region) | Staging in use |
| Resend | Transactional email | Email address, message content (notifications only) | [confirm in Resend's terms] | Staging in use |
| [Error monitoring: TBD] | Error reports with credentials redacted | Technical metadata | [TBD] | Not chosen |
AI providers (chosen by the customer)
Anthropic, OpenAI, Google (Gemini API), and xAI are used only when the customer connects their own API key and selects that provider for a run. Content is processed under the customer's own account and that provider's terms, retention, and data policies. For example, some free tiers allow the provider to use content to improve its products, so customers should use paid-tier keys for client data and check the provider's current terms.
Web search (Brave or Tavily) works the same way: queries go only to the search provider whose key the customer connected.
We never send content to a provider the customer didn't select. There is no automatic fallback to another provider.