Sub-processors
Last updated:
Who processes data for us
We use these providers to run gr0.ai. "Always" means the provider is part of the service for every customer. The others are used only if a customer turns on the related feature or connects its own account, or a person connects their own calendar. Where a customer connects its own account with a provider (for example its own Stripe, Twilio or Plaid account), the customer's agreement with that provider also applies.
| Provider | What for | Data | Where | Used |
|---|---|---|---|---|
| Hetzner Online GmbH | Servers that run the application, database, background workers and our AI tracing (Langfuse, open-source software we run ourselves) | All service data (stored on our servers) | Hetzner data centers | Always |
| Cloudflare, Inc. | DNS, network protection and content delivery in front of the service; Turnstile bot checks on sign-in; system email delivery and inbound email routing; object storage (R2) for uploaded files and for our encrypted database backups | Requests to the service (including IP address), sign-in security signals, system and inbound emails, uploaded files, encrypted backups | Global network | Always |
| Twilio Inc. | Text messages, phone calls and phone-number verification | Phone numbers, message content, call audio and metadata | United States and Twilio regions | Always |
| Google LLC (Gemini API) | AI models (the default AI model provider) | The text an AI feature is asked to work on; never bank, credit, identity or calendar data, which go only through OpenRouter as below | United States | Always |
| OpenRouter, Inc. | Routes AI requests to the model providers behind it. Requests on paid models carry a no-data-collection preference; requests with calendar events also require zero data retention | The text an AI feature is asked to work on | United States | Always |
| NVIDIA Corporation | Free AI models, used only for an organization that allows free models | The text an AI feature is asked to work on; never bank, credit, identity or calendar data | United States | Only if your organization enables it |
| Amazon Web Services (SES) | Sending and receiving email for an organization that connects its own SES account | Email content and addresses | AWS region the organization chooses | Only if your organization enables it |
| SendGrid (Twilio Inc.) | Email delivery for an organization that connects its own SendGrid account | Email content and addresses | United States | Only if your organization enables it |
| Vapi | AI voice agents that answer or place calls | Call audio, transcripts, contact name and phone number | United States | Only if your organization enables it |
| Stripe, Inc. | Card and bank payments that an organization takes from its own customers | Payer name, email, payment details (entered at Stripe) | United States | Only if your organization enables it |
| Plaid Inc. | Bank connection for funding applications | Bank account and transaction data the applicant authorizes | United States | Only if your organization enables it |
| Experian | Credit reports, only with the person’s written authorization | Name, address, identifiers, credit report | United States | Only if your organization enables it |
| Persona Identities, Inc. | Identity verification | Government ID image, selfie, name, date of birth | United States | Only if your organization enables it |
| Google LLC (Calendar) | Calendar sync for people who connect a Google Calendar | Events on the person’s primary calendar and the account email | United States | Only if a person connects their calendar |
| Microsoft Corporation (Graph) | Calendar sync for people who connect a Microsoft 365 or Outlook calendar | Events on the person’s calendar and the account email | Microsoft regions | Only if a person connects their calendar |
Changes
We will update this list before adding a provider that processes customer data, and tell customers who ask to be notified. To object to a new provider, email [email protected]. See also the Privacy Policy.