Subprocessors
Effective: 2026-08-10 · Version: 1.0 · Last verified: 2026-08-09
These are the third-party companies that process personal data on our behalf when you use AgentSynth. This page is separate from the Privacy Policy so it can be kept current as the list changes.
We will update this page before adding a new subprocessor, not after.
Current subprocessors
| Provider | What it does | What it receives | Location | Transfer basis |
|---|---|---|---|---|
| Google Cloud Platform (Google LLC) | Hosts our API, stores logs, runs monitoring | All request data, IP addresses, error details | United States (us-central1) | EU–US Data Privacy Framework — Google LLC is a certified participant |
| Google LLC (Sign-in) | Authenticates you when you sign in with Google | The fact that you signed in to AgentSynth; returns your account identifier, email and name to us | United States | EU–US Data Privacy Framework |
| Neon, a Databricks company (Databricks, Inc.) | Hosts our PostgreSQL database | Account records, hashed authentication tokens, subscription status | United States (AWS) | EU–US Data Privacy Framework — Databricks is certified for the EU–US DPF, the UK Extension and the Swiss–US DPF |
| Cerebras (Cerebras Systems Inc.) | Runs the AI model that generates patches | Your prompt text and your current patch data | United States | Transfer safeguard pending — see note below |
| Polar (Polar Software Inc.) | Merchant of Record — sells, invoices, handles tax, manages subscriptions | Your billing identity and subscription details | United States | Standard Contractual Clauses (EU Commission Decision 2021/914, Module 2) and the UK IDTA |
| Cloudflare (Cloudflare, Inc.) | Hosts agentsynth.app | Website visitor IP addresses and request logs | Global edge network | EU–US Data Privacy Framework — active participant |
The AI provider, in detail
This is the one worth reading carefully.
When you use hosted AI generation, your prompt text and the JSON representation of your current patch are sent to Cerebras for processing. Nothing else about you is sent — no name, no email address, no account identifier.
Cerebras does not retain the content of your prompts. Their published position, verified 2026-08-09, is that they do not store prompt content, API requests or responses, chat or transaction logs, or user input and model output. Their privacy policy states: "We do not retain inputs and outputs associated with our training, inference and chatbot Services." What they do retain is limited to operational data — organisation name, account email, and usage metrics such as throughput and billing volume.
Sources: Cerebras privacy policy · Cerebras support: "Does Cerebras retain my data?"
International transfer safeguard: not yet in place. Checked 2026-08-09 against the official EU–US Data Privacy Framework participant list, Cerebras' own privacy policy, and their SafeBase trust center — none show a DPF certification, and Cerebras publishes no Standard Contractual Clauses or DPA addressing this. A DPA request is drafted (see 09-dpa-register.md) and pending; this row will be updated the moment it lands. Publishing "pending" here rather than a false "Standard Contractual Clauses" claim is the correct order of operations, not a blocker on publishing — see 00-checklist.md §I, step 1 (publish) precedes step 4 (chase the DPA).
We do not use your prompts or patches to train any model, and our agreements do not permit our providers to do so on our behalf.
Local mode sends nothing. Running a model locally through Ollama keeps every prompt and patch on your own machine. No subprocessor on this page is involved.
Payments and the Merchant of Record
Polar Software Inc. is our Merchant of Record. That means Polar — not us — is the legal seller for your purchase. Polar issues your invoice, collects and remits VAT or sales tax in your jurisdiction, and hosts your billing portal.
We receive only your subscription status and a customer identifier from Polar. We never see, receive or store your payment card details.
Polar engages its own subprocessors, including payment and identity infrastructure. Those are governed by Polar's own agreements rather than ours — see Polar's subprocessor list and Polar's privacy policy.
Planned changes
We publish these in advance so there are no surprises.
- A second AI inference provider is planned, for automatic failover when the primary provider has an incident (roadmap P6·5). It will be added to the table above before it goes live.
Not on this list, and why
Some companies you might expect to see here are deliberately absent:
- Stripe — Stripe is Polar's subprocessor, not ours. We hold no agreement with Stripe covering your data, and your payment information reaches Stripe through Polar rather than through us. It appears on Polar's subprocessor list, linked above.
- Analytics vendors — there are none. Our product usage numbers are counted in our own database, and our website statistics are cookieless aggregates. We did not want the extra data-sharing relationship, and it means there is no cookie banner.
Questions
privacy@agentsynth.app