| Processor | Purpose | Data received | Location | Art. 28 instrument | Transfer safeguard |
|---|---|---|---|---|---|
| Cloudflare, Inc. | Hosting of the backend (Workers), key-value store, counters, request logs, and hosting of these legal pages | Recognised letter text in transit; install token hashes; counters; log metadata | Global edge network | To be confirmed | To be established |
| Anthropic PBC | AI inference for the explanation and reply drafting | The recognised text of the letter | Per Anthropic's terms | To be confirmed | To be established |
| Mail provider | Support and privacy correspondence | Whatever a user sends us | To be determined | Not yet selected | — |
|---|
Not a subprocessor: Apple Inc. handles distribution and payment under its own relationship
with the user and receives no document data from us.
Not subprocessors either — independent controllers (since 1.3.0): Meta Platforms Ireland Limited
(Meta App Events SDK) and TikTok Technology Limited (TikTok App Events SDK) receive, with the user's
App Tracking Transparency permission, the device's advertising identifier and a closed list of generic
events for the measurement of our own advertising, and process them for their own purposes under
their own terms. They receive no document data, are not involved in the AI analysis, and are described
in the privacy policy, Section 6 and Section 8 (docs/ATTRIBUTION_PRIVACY_CHECKLIST.md).
Alternative configuration. The backend can run inference on Cloudflare Workers AI instead of
Anthropic, which removes the second row entirely at the cost of output quality. This is a live
option, not a theoretical one.
Adding a subprocessor that receives user content requires, in the same change: this page, the
in-app consent text (which names where the text goes), the privacy policy, the privacy manifest,
and an Art. 28 instrument. Users will be informed in-app before any such change takes effect.