Sub-processors
Named sub-processors: who processes what data, where, and for what purpose.
On this page
We use the following sub-processors to deliver the service. Each entry states the purpose, the data they see, and their region. Changes to this list are announced by email before they take effect.
Current sub-processors
- Cloudflare, Inc.
- Purpose: Edge routing and DDoS protection, TLS termination, API router runtime (Cloudflare Workers), console application runtime (Cloudflare Workers), database for accounts and billing (Cloudflare D1), encrypted capture archives and artifact storage (Cloudflare R2), cookieless analytics (Analytics Engine), outbound email delivery and contact-form notifications.
Data they see: Request routing metadata (IP addresses, HTTP headers, paths) during edge transit; account data (email, key prefixes, credit balances, billing metadata) in D1 database; console application data (account sessions, billing records) in Worker runtime; outbound emails (recipient address, email content). Prompts and completions transit the edge to the compute provider; eligible captured content is also archived, encrypted, in R2 under the capture policy.
Region: Global infrastructure; this policy does not promise EU-only D1 or R2 storage. - Paddle.com Market Ltd (Paddle)
- Purpose: Payment processing, tax calculation, invoicing, saved payment method storage. Paddle is the merchant of record.
Data they see: Payment card details (we never see your card), billing address, purchase amounts, customer reference. Paddle returns a customer reference and last four card digits so the console can show your saved payment method.
Region: UK and EU (Paddle entity). - Verda Oy
- Purpose: GPU compute infrastructure for running the standing DeepSeek-V4.1-Flash trial since 2026-09-19 at 06:43 UTC.
Data they see: Request content in process and accelerator memory, including prefix-cache state. Eligible captured content is stored on the host before encrypted archival to R2. For purchased-credit traffic with training off (the default), prompts and completions are never written to durable storage on Verda Oy infrastructure. Billing metadata (token counts, timestamps, no content) and operational logs (status codes, latency, no content) exist on the compute host for up to 30 days.
Region: Finland (FIN-01). - Calendly LLC
- Purpose: scheduling the calls booked from this site.
Data they see: the name, email address and time slot you enter on the booking page.
Region: United States. - LinkedIn Ireland Unlimited Company
- Purpose: crediting a LinkedIn ad when a booking follows a click on it.
Data they see: the booking time, a one-way hash of the email address given to the scheduling page, a hashed booking identifier, the conversion rule identifier and, when supplied, your first and last name, sent from our server; nothing for bookings that did not come from a LinkedIn link.
Region: Ireland, with onward transfer under LinkedIn's terms. - Email delivery provider
- Purpose: Transactional email delivery (account sign-in links, billing notifications, service announcements) and owner notifications containing contact-form submissions.
Data they see: Recipient email address, email content, including details and free text submitted through contact forms, not a feed of API prompts or completions.
Region: Delivered via Cloudflare email infrastructure.
Note: Email is sent through Cloudflare's own email binding, so this is Cloudflare rather than a separate vendor - there is no additional separate sending vendor in this path. Recipient mailbox providers also process delivered mail.
Cloudflare provides Pages and Workers delivery, D1 databases, R2 archives, Analytics Engine and outbound email. GLM-5.3-Flash was served from Nebius UK (uk-south2) from 2026-09-13 to 2026-09-19; Nebius holds no customer content now; Verda Oy (Finland, FIN-01) is the only GPU-inference sub-processor (DeepSeek-V4.1-Flash). Paddle processes payments. Calendly processes details you submit when booking a call. For LinkedIn-attributed bookings, LinkedIn receives booking time, a hashed email address, a hashed booking identifier, the conversion rule identifier and, when supplied, first and last name.
Captured training data is subject to a 24-month deletion policy; account closure starts a 30-day purge deadline, whichever comes first. Purging is performed by our deletion process, with overdue closure alerts and a validated deletion receipt; turning consent off stops new capture, not the retention clock for existing data.
Historical sub-processors
GLM-5.3-Flash was served from Nebius UK (uk-south2) from 2026-09-13 to 2026-09-19; Nebius holds no customer content now; Verda Oy (Finland, FIN-01) is the only GPU-inference sub-processor (DeepSeek-V4.1-Flash).
What sub-processors do not see
- Cloudflare routes request content and stores eligible encrypted capture archives in R2, separately from content-free billing records.
- Paddle does not see prompts, completions, or API activity; only payment transactions.
- Verda Oy: Purchased-credit requests with training off are not written to the durable capture corpus or used for training or evaluation. With capture enabled, accounts marked for promotional use or explicit training consent may have eligible prompts and completions stored on the serving host and archived, encrypted, in Cloudflare R2. Prompt prefixes may remain in engine memory after a response until evicted or the process restarts. The gateway namespaces prefix reuse by account and cache_salt, not by individual API key.
- Email provider receives the emails we send, including contact-form notifications; API request bodies are not sent as email notifications.
Changes to this list
Adding or replacing a sub-processor is announced by email at least 30 days before it takes effect, like every change that widens what happens to your data. You may object before the change takes effect; if we cannot accommodate the objection, you may terminate the service. The date at the top moves with every change.
Data Processing Addendum
See the Data Processing Addendum for processor roles, security measures, and data subject rights.