Legal
Subprocessors
Last updated: 30 September 2026
We use the following subprocessors. Each one processes personal data only on our behalf, under a data processing agreement. We update this page before we add or replace a subprocessor.
Current subprocessors
| Provider | Purpose | Data processed | Location | Transfer safeguard |
|---|---|---|---|---|
| Clerk | Sign-in, user accounts and sessions | Name, email address, sign-in and session data | USA | EU-US Data Privacy Framework |
| Convex | Database, file storage and backend functions | Account, mailbox, AI and usage data | EU region | Data stored in the EU; DPF or SCCs for any access from outside the EU |
| Qdrant Cloud | Search index | Search vectors derived from email text, with references to your emails | EU region | Data stored in the EU |
| OpenAI | Embeddings for search, AI answers and drafts | Email text, questions and relevant email excerpts | USA, or EU where EU data residency is configured | EU-US Data Privacy Framework and SCCs |
| Anthropic (optional) | AI answers and drafts, only if selected | Questions and relevant email excerpts | USA | Standard Contractual Clauses (SCCs) |
| Resend | Transactional email, such as “your export is ready” | Email address and notification content | EU sending region | DPF or SCCs for any access from outside the EU |
| Vercel | Hosting and content delivery for the website and app | IP address and request data | Global edge network; USA | EU-US Data Privacy Framework or SCCs |
| Stripe (where enabled) | Payments and invoicing | Name, email address, billing address, VAT ID, payment details | EU and USA | EU-US Data Privacy Framework or SCCs |
| Neon (where enabled) | Pseudonymous usage analytics | Pseudonymous usage metrics, never email content | EU region | DPF or SCCs for any access from outside the EU |
“Where enabled” means the provider is only used once that feature is switched on. Until then, no data is sent to it. DPF = EU-US Data Privacy Framework (Art. 45 GDPR); SCCs = Standard Contractual Clauses (Art. 46(2)(c) GDPR).