Sub-processors
Last updated: 2026-10-20
This page provides a transparency list of current sub-processors that may process data for UniDeck.ai.
1. Approach
- Sub-processors are used only to the extent necessary to provide the service.
- Where applicable, we apply DPA/SCC or equivalent contractual safeguards.
- Provider changes are reflected on this page first.
2. Sub-processor List
| Provider | Category | Purpose | Data Types | Transfer Region | DPA / Privacy |
|---|---|---|---|---|---|
| Vercel AI Gateway | AI model routing | Model call routing and orchestration | Prompts, model-call metadata | Global (provider dependent) | Privacy, DPA |
| Typesafe AI (via Vercel AI Gateway) | AI model routing | Choosing a model tier for chats set to Auto | Latest request, short conversation excerpt, attachment counts | Global (provider dependent) | Privacy, DPA (via Vercel) |
| OpenAI | LLM provider | Text/multimodal response generation | Prompts, output content, technical metadata | Global (provider dependent) | Privacy, DPA |
| Anthropic | LLM provider | Text response generation | Prompts, output content, technical metadata | Global (provider dependent) | Privacy, Trust |
| Google (Gemini/Google AI) | LLM provider | Text and file-based AI processing | Prompts, output content, technical metadata | Global (provider dependent) | Privacy, Cloud DPA |
| xAI (via Vercel AI Gateway) | LLM and image provider | Grok text and image models chosen in the model picker | Prompts, output content, technical metadata | Global (provider dependent) | Privacy |
| Perplexity (via Vercel AI Gateway) | Web search | Web search for chats and the Sonar models chosen in the model picker | Search queries, prompts, output content, technical metadata | Global (provider dependent) | Privacy |
| ElevenLabs | Speech to text | Turning dictated voice input into text | Audio you record for dictation, transcript | Global (provider dependent) | Privacy, DPA |
| Composio | Tool integrations | Connecting your third-party apps and running the actions you approve in them | Connection credentials for apps you connect, tool inputs and outputs | United States | Privacy, DPA |
| Cloudflare R2 | Cloud object storage | Storage for uploaded files | File content and file metadata | Global (account configuration dependent) | Privacy, DPA |
| Railway (managed PostgreSQL hosting) | Database infrastructure | Primary application data storage | Account, chat, transaction, and usage data | Provider dependent | Privacy, DPA |
| Google OAuth (via better-auth) | Authentication | Social sign-in workflow | Authentication profile data (name, email, etc.) | Global (provider dependent) | Privacy |
| Microsoft, Amazon, LinkedIn (sign-in) | Authentication | Social sign-in workflow, when you choose one of them | Authentication profile data (name, email, etc.) | Global (provider dependent) | Microsoft, Amazon, LinkedIn |
| DeBounce | Abuse prevention | Checking whether a sign-up email uses a disposable-email domain | Email domain only (never the full address) | Provider dependent | Privacy |
| Polar | Payment infrastructure | Subscription, billing, and payment event processing | Customer/subscription references, transaction data | Global (provider dependent) | Privacy |
| Resend | Transactional email | Verification, password reset, and notification emails | Email address, delivery metadata | Global (provider dependent) | Privacy, DPA |
| Meilisearch | Search engine | Chat/data search indexing | Indexed content and metadata | Provider dependent | Privacy |
| Vercel Analytics | Analytics | Product usage analytics | Usage and technical interaction data | Global (provider dependent) | Privacy, DPA |
| PostHog | Analytics | Product analytics and, with consent, session recordings of the sign-up and checkout pages | Pseudonymous account ID, usage events, page interactions with form inputs and email addresses masked | United States | Privacy, DPA |
| Google Analytics | Analytics | Traffic and interaction analytics; with consent, paid orders and trial starts reported from our servers | Cookie/device and usage metadata, Google Analytics client ID, order ID and amount | Global (provider dependent) | Privacy, Data Terms |
| Google Ads (incl. Data Manager API) | Advertising measurement | With consent, matching sign-ups and payments to Google ad clicks | Ad click identifiers, hashed (SHA-256) email address, order ID, amount and currency | Global (provider dependent) | Privacy, Ads processor terms |
3. Notes
- This is a living inventory and may be updated as infrastructure changes.
- This page should be read together with the Privacy Policy.