Sub-processors
Last updated: 2026-06-14 · Version 1.0.0-draft
The following sub-processors process personal data on our behalf. Their respective DPAs are accepted via their published terms of service; we do not maintain a separately-signed DPA with any of them. See our Privacy Policy §4 for context.
| Name | Purpose | Data categories | Region | DPA |
|---|---|---|---|---|
| Cloudflare, Inc. | Static hosting (Pages), edge compute (Workers), application database (D1) | Account identifier, Session cookie, Wallet balance, Request metadata | Global edge | DPA |
| WorkOS, Inc. | Authentication (AuthKit / Google OAuth) | Email address, Display name, OAuth provider identifier | United States | DPA |
| Armitage Labs OÜ (Creem) | Payment processing (Merchant of Record) | Email address, Billing address, Card details (Creem-side only) | Estonia (EU) | DPA |
| OpenRouter, Inc. | Large language model inference (character card enrichment) | Prompt text (user-authored card fields), Model completion | United States | DPA |
List last reviewed: 2026-06-14. We notify users of material changes by email at least 14 days in advance.