Sub-processors — DRAFT
Public list required by our Privacy Policy and Team/Business DPA. Founder: confirm each region and sign each DPA (task due by 22 Oct).
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Supabase | Account database, sign-in, encrypted team data, server functions | Email, plan, devices, consents, encrypted team data | India (Mumbai, AWS ap-south-1) |
| Paddle | Payments, tax, invoices (Merchant of Record) | Name, email, billing details, purchase history | UK / EU / US |
| Resend | Transactional and product email | Email address, email content we send | US |
| Cloudflare | Website hosting, DNS, privacy-friendly web analytics | IP address (not stored for analytics), website requests | Global |
| Google (Gemini API / Vertex AI) | Cloud AI credits (opt-in), sign-in with Google, Drive backup at your request | AI request content in transit; Google sign-in token | Global (Google); India region where available |
| OpenAI | Backup cloud AI provider (opt-in cloud AI only) | AI request content in transit | US |
| Sentry | Opt-in crash reports (content scrubbed) | Error data, browser version | EU (Germany) |
| Google Workspace | Support and company email | Your emails to us | Global |
| InboxSDK (Streak) | Gmail integration library for Promax Mail | To be confirmed before Promax Mail launches | US |
We give 30 days’ notice of new sub-processors to Team and Business customers.