Subprocessors
The companies that process personal data for SeedBasis, what each receives, where, and under which safeguards.
Last updated 23 October 2026 · Markdown version
Last reviewed 28 September 2026. A subprocessor is a company that processes personal data on our behalf to run SeedBasis. Each one receives only the data it needs and is bound by contract. The safeguards shown are the providers' own published statements.
1. Providers that process data for us
| Provider | What for | Data it receives | Where | Transfer safeguards |
|---|---|---|---|---|
| Amazon Web Services (AWS) | Hosting the website, the app, background jobs and the database, on a server we run | All data the service handles: accounts, reports, conversations, billing and security records | Germany (Frankfurt). AWS does not move it out of that region except to provide the service, or as the law or a binding order requires | AWS's data processing addendum (GDPR Art. 28), which applies automatically and includes the European Commission's standard contractual clauses and the UK addendum |
| OpenRouter, Inc. | Routing every request to the AI models that research reports, answer your questions to the agent, find posts on X, say which products they recommend for a kind of product, and hear you and speak when you talk with a report, each to the model's maker only | Onboarding answers, report content, agent conversations, the text of documents you attach that the agent or deep research reads, the pictures of a scanned PDF's pages, search terms, and, when you talk with a report, the recording of what you say and the agent's spoken answers, passed on to the model's maker. It does not store prompts, responses or recordings, only request details such as token counts. | United States | Its data processing agreement, which its Terms of Service apply to commercial customers, and standard contractual clauses for transfers from the EEA and the UK, as its privacy policy states |
| Fireworks AI, Inc. | Running an open model made by Z.ai, which writes the research brief, checks each finding's citations, and writes the plans, each group's page and the report summary, and answers your questions to the agent while Google is too busy to answer. OpenRouter sends each of these requests to Fireworks AI or Together AI; Z.ai receives nothing | Onboarding answers, report content and, when it answers for the agent, agent conversations. It keeps no copy: requests run only on its endpoints with zero data retention | United States | Standard contractual clauses, or the UK's equivalent, for transfers from the EEA and the UK, as its privacy policy states. We reach it through OpenRouter, under OpenRouter's agreement with it |
| Together Computer, Inc. (Together AI) | Running the same open model for the same jobs, as the other host OpenRouter may send those requests to | Onboarding answers, report content and, when it answers for the agent, agent conversations. It keeps no copy: requests run only on its endpoints with zero data retention | United States | The European Commission's standard contractual clauses, as its privacy policy states. We reach it through OpenRouter, under OpenRouter's agreement with it |
| Google LLC (its paid AI API and Vertex AI) | Running the models that plan and write the research and answer your questions to the agent, asking Google's model which products it recommends for your kind of product, and turning what you say on a call into text when ElevenLabs cannot, reached through OpenRouter at either Google endpoint | Onboarding answers, report content, the sources collected, agent conversations and the text of documents you attach that the agent or deep research reads, the pictures of a scanned PDF's pages, to copy out their words, and, only when ElevenLabs cannot turn it into text, the recording of what you say on a call. Every request of a call with a report, the agent's included, runs only on its endpoints that keep no copy. Google keeps a request for up to 55 days to detect abuse and then deletes it, except a request carrying a document you attached or its pages' pictures, and every request of a company report that carries your own figures or documents, which run only on its endpoints that keep no copy. Its paid API terms do not allow it to train on what it receives. | United States and other countries | Google's data processing terms for its paid AI API and Vertex AI, with standard contractual clauses and the UK addendum, and Google LLC's certification under the EU-U.S. Data Privacy Framework and its UK extension. We reach it through OpenRouter |
| Tavily (AlphaAI Technologies Inc., part of Nebius) | Web search while researching reports | Search terms derived from your idea, never the idea text or anything about your account; for a report about a company you run, also the company's name and website, which are public, never the figures or documents you give us. Its privacy policy says it may use search queries to improve its service unless a contract says otherwise. | United States | None needed for search terms, which carry nothing about you. Its privacy policy names standard contractual clauses with the UK addendum for its enterprise customers |
| SpaceXAI LLC (xAI) | Finding public posts on X while researching reports, with its own model | Search terms derived from your idea, never the idea text or anything about your account; for a report about a company you run, also the company's name and website, which are public, never the figures or documents you give us. We use it only with zero data retention switched on, so it keeps no copy of the requests. | United States | Its data processing addendum, with standard contractual clauses. We reach it through OpenRouter, with zero data retention |
| Microsoft Corporation (Bing Webmaster Tools) | How often search terms are searched on Bing, while researching reports | Search terms derived from your idea, never the idea text or anything about your account; for a report about a company you run, also the company's name and website, which are public, never the figures or documents you give us | United States | Microsoft Corporation's certification under the EU-U.S. Data Privacy Framework and its UK extension. Search terms carry nothing about you |
| DataForSEO OÜ | How often search terms are searched on Google and what advertisers pay for them, and how much search traffic competitors' websites get, while researching reports | Search terms derived from your idea, phrases from public comments and reviews, and competitors' website addresses, never the idea text or anything about your account; for a report about a company you run, also the company's website address, never the figures or documents you give us. Its privacy policy says it deletes stored data after 365 days. | Estonia; it also has an office in Ukraine, and its own processors include companies in the United States and Germany | None needed for search terms, which carry nothing about you. Its privacy policy says it relies on standard contractual clauses or adequacy decisions for transfers to its own processors |
| Eleven Labs Inc. (ElevenLabs) | Turning what you say into text, and the agent's answers into speech, when you talk with a report, reached through OpenRouter | The recording of what you say on a call, and the agent's answers as text, which can quote your report. It keeps no copy: requests run only on its endpoints with zero data retention | United States | Its certification under the EU-U.S. Data Privacy Framework, as its privacy policy states. We reach it through OpenRouter, under OpenRouter's agreement with it, with zero data retention |
| OpenAI | Asking its GPT model which products it recommends for your kind of product, once a report, and speaking the agent's answers on a call when ElevenLabs cannot, reached through OpenRouter at OpenAI's own endpoints | A few words naming a kind of product, never your idea text or anything about your account; and, only when ElevenLabs cannot speak them, the agent's answers on a call as text, which can quote your report, never the recording of your voice. OpenAI keeps API requests for up to 30 days to monitor abuse and does not use API data to train its models. | United States | None needed for words that carry nothing about you. For a call's answers, we reach it through OpenRouter, under OpenRouter's agreement with it |
| Anthropic, PBC | Checking, with its model, the claims a report's answer rests on against web pages read that day, before the report's decision pages are written; reading the finished report once, after every page is written, to find and rewrite places that disagree or state what their findings do not give; and asking its model which products it recommends for your kind of product, once a report. Reached through OpenRouter at Anthropic's own endpoints | For the check: the research brief's description of your idea and its customers, the report's claims with the quotes they rest on, and passages of the public pages read. For the final read: the report's pages, which can restate what you told us about your idea, budget and time, the claims of the findings they cite, and its verdict. Never your name, email address or account details, and nothing of a report about a company you run that carries figures you typed or documents you attached, which skips the check and whose final read runs on Google's model where nothing is kept. For the question: a few words naming a kind of product. Anthropic's endpoints do not offer zero data retention through OpenRouter; it deletes API requests within 30 days, and its commercial terms do not allow it to train models on them. | United States | We reach it through OpenRouter, under OpenRouter's agreement with it |
| Resend (Plus Five Five, Inc.) | Sending account, security, report and billing emails, product news and offers you asked for, and delivering what you send through the feedback form to us | Your email address and each email. Emails to you never contain idea text or report content; feedback you send carries what you wrote, any images you attached, your name, email address and account ID, the page it was sent from and your browser's name | United States, on Amazon Web Services | Standard contractual clauses with the UK addendum, and certification under the EU-U.S. Data Privacy Framework and its UK extension |
| Cloudflare, Inc. | Carrying all traffic between your browser and our server through its network, which protects the site against attacks; the Turnstile bot check on sign-up, password reset, and sign-in after repeated failures; and forwarding email sent to our support, privacy, security, legal and feedback addresses to our inbox | Everything sent between your browser and SeedBasis while it is in transit, including your IP address and browser details; for the bot check, also a TLS fingerprint and our site key; and the emails it forwards, including feedback you send from the app | Cloudflare's global network; a United States company | Standard contractual clauses with the UK addendum, the Data Privacy Framework, and Global CBPR certification, under its data processing addendum |
| Google LLC | Google Analytics on our public marketing pages, only if you allow analytics cookies | Cookie identifiers, pages viewed, device and browser details, and IP address | United States and other countries | The Google Ads Data Processing Terms, which cover Google Analytics, with standard contractual clauses |
2. Companies that receive data as independent controllers
These companies are not our subprocessors. They decide how they use the data they receive, under their own privacy policies. We list them so the picture is complete.
| Company | Role | Data | Their policy |
|---|---|---|---|
| Sold through Link, LLC, a Stripe company (United States) | Merchant of record: sells credits and top-ups, takes payment through Stripe, and handles sales tax and VAT, receipts, invoices, payment support and disputes | What you enter at checkout, such as your email address, name, billing address and payment details; the email address and account ID of your SeedBasis account, which we pass to checkout so the purchase reaches your account; and your purchase history | Link's privacy policy |
| Stripe, Inc. (United States) | Processes the payments Link takes, and gives us the record of each purchase and refund | The same checkout data, and the payment's outcome | Stripe's privacy policy |
| Sign in with Google, if you choose it | The sign-in, and the account details Google shares with us | Google's privacy policy | |
| Provides the Gmail inbox our support, privacy, security, legal and feedback addresses forward to | What you send to those addresses or through the feedback form | Google's privacy policy | |
| Apple | Sign in with Apple, if you choose it | The sign-in, and the name and email address, or private relay address, you choose to share | Sign in with Apple and privacy |
| An AI assistant you connect | Reads your reports through our MCP server, with your permission | Whatever it reads | Your agreement with the assistant's provider |
3. Public data sources
To research a report, we query public sources such as GitHub, npm, PyPI, Stack Exchange, Crossref, trademark registers, court records and public web pages. They receive search terms derived from your idea, never the idea text itself, and nothing about your account. For a report about a company you run, they also receive the company's name and website, which are public, and never the figures or documents you give us; the company is looked up in registers such as the UK's Companies House, and set against business statistics from Eurostat and the US Census Bureau. They are not subprocessors.
4. Changes to this list
We update this page at least 14 days before a new subprocessor starts processing personal data, and change the date at the top. For a copy of a provider's safeguards, or any question about this list, write to privacy@seedbasis.com.