Subprocessors
Draft for legal review. Not yet in force.
These are the providers that handle your information on our behalf. The Privacy Policy explains how long we keep it.
| Provider | Purpose | Region | Data it receives |
|---|---|---|---|
| Supabase | Database, sign-in and file storage | Sydney (ap-southeast-2) | Everything you store: account details, transcripts, documents, uploads, boards, AI conversations, error reports and usage counts |
| Vercel | Hosting the app, running its server code, and page-view analytics | Sydney (syd1) for the app's server code; [verify: where Vercel processes analytics and logs] | Every request to the app, including the content of pages and forms as they pass through. [verify: Vercel Web Analytics is enabled on the project] If it is, it counts page views. |
| Anthropic (Claude) | AI suggestions, drafts and chat. The default AI | [verify: region where Anthropic processes requests] | The text needed for the request: transcripts, documents, highlights, themes, insights, board content, chat messages and attached images or files |
| Google (Gemini) | AI suggestions, drafts and chat, for people who choose it under AI model on their profile or in a conversation's Model menu | [verify: region where Google processes requests] | The same as Anthropic, when Gemini is chosen |
| Cloudflare (Turnstile) | A check that sign-up, log-in and password reset are not automated. It also loads with the sign-up and log-in form on the home page, so it runs when that page is opened [verify: wording on the check loading on the home page] | [verify: Cloudflare region] | Browser signals and the visitor's IP address, as part of the check [verify: Cloudflare Turnstile data terms] |
| [email provider: to be chosen] | Sign-in emails and invites | [verify: region] | Recipients' email addresses and the message content |
| [uptime monitor: to be chosen] | Checking that the service is up | [verify: region] | A request to a public health address; no customer data |
[verify: the data protection terms in place with each provider, and whether any provider uses data for training. Nothing on this page states a provider's own terms.]
We will update this page when a provider is added or removed. [verify: how account holders are told.]