Last reviewed: October 29, 2026.
This is the current list of third-party services that process any IntelliPrompter user data. We maintain it here, in public, so that vendor changes do not require re-notification of the Privacy Policy. For context on what data we collect, why, and under which legal basis, read the policy itself. For the system-level data flow and controls behind these vendors, see our security page.
Each entry below lists the vendor, what they do for us, the categories of data they process, where they run, and a link to the vendor's Data Processing Agreement where one is publicly available. "Worldwide" means the vendor operates a global footprint and the data is routed to the nearest region at the vendor's discretion. When the list changes, the change is logged at the bottom of this page with a date and a reason.
| Vendor | Purpose | Data types processed | Location | DPA |
|---|---|---|---|---|
| Supabase | Postgres database for the waitlist and blog subscriber tables; account auth once the authed shell is live. | Email address, waitlist metadata (role, use case, source, how-did-you-hear), IP address, user agent, timestamps, OAuth provider identifier for signed-in accounts. | United States | Supabase DPA |
| Resend | Transactional email delivery (waitlist confirmations, admin notifications, future receipts and account-security emails). | Email address, email contents. | United States | Resend DPA |
| StripeFuture | Payment processing. Not yet live. When paid tiers launch, Stripe will handle checkout, card storage, invoicing, and tax calculation. | Billing contact, payment method token (card data is tokenized by Stripe and never touches our infrastructure), subscription history. | United States | Stripe DPA |
| Vercel | Marketing-site hosting, edge functions, OAuth callback relays, first-party analytics, Core Web Vitals. | Request logs, aggregate page views, aggregate performance metrics. No cookies set by us; Vercel Analytics is cookie-free. | Global edge, headquartered in the United States | Vercel DPA |
| Google (Sign-in) | OAuth 2.0 sign-in when you choose Google as your identity provider. | Email address, Google account identifier, name, profile picture URL if returned. | Worldwide (Google Cloud) | Google Cloud DPA |
| Google (Drive) | Per-file access to files you pick for use as meeting-prep context, via the drive.file scope only. | Metadata and content of files you explicitly pick through Google's file picker. No broad Drive access. Picked content is embedded on-device and never passes through our servers. | Worldwide (Google Cloud) | Google Cloud DPA |
| Microsoft | OAuth sign-in when you choose Microsoft as your identity provider. | Email address, Microsoft account identifier, name. | Worldwide (Microsoft Cloud) | Microsoft DPA |
| Atlassian | Read-only Jira and Confluence access for meeting-prep context, via OAuth 2.1 with a hosted redirect relay on our edge. | Issue metadata, Confluence page content, and user data you authorize us to read. Pulled on-demand and summarized on-device. | Worldwide (Atlassian Cloud) | Atlassian DPA |
| GitHub | Source control and issue tracking for the product itself. User data does not flow here. | Our source code and backlog. No customer data. | Worldwide | GitHub DPA |
| Upstash Redis | Rate limiting on public signup endpoints. | Short-lived hashed IP addresses, request counters. | United States, multi-region | Upstash DPA |
| AI providers (BYOK) | Coaching and Ask-AI inference when you connect a provider key. Includes Anthropic (Claude), OpenAI (GPT family), Google (Gemini), and optionally Ollama (local). | The recent transcript window, your prompt, your system-prompt context. Sent directly from your machine to the provider using your key. Our infrastructure is not in the path. | Provider-specific. See each provider's policy. | See each provider |
| Hugging Face Hub | One-time model downloads at install (Whisper, embedding model, diarization model). | Request metadata for the download itself. | Worldwide | Hugging Face terms |
The "AI providers (BYOK)" row is the most important one to understand. When you use Anthropic, OpenAI, Google, or Ollama through bring-your-own-key, the request is formed on your device, authorized with your API key, and sent directly to the provider. IntelliPrompter does not operate a proxy. We do not have the ability to read, log, or retain the content of that request. The provider's own privacy policy and DPA govern what happens on their side. Ollama runs on your machine, so there is no outbound call at all.
Every change to the list above is recorded here, with the date it took effect and a short reason. New entries are appended at the top. Removed vendors stay in the log with a strike-through so you can see what used to be in scope.
| Date | Change | Reason |
|---|---|---|
| 2026-10-29 | Initial list published. | First version of the public subprocessor registry, extracted from the Privacy Policy so vendor changes can ship without re-notification of the policy. |
If you have an active contract with IntelliPrompter that requires advance notice of new subprocessors, we will email the contact on your account at least 30 days before a new vendor starts processing your data, and you can object before the change takes effect. For general users and waitlist subscribers, this page is the notification mechanism. Subscribe to updates by emailing privacy@intelliprompter.com with "Subscribe to subprocessor updates" in the subject line and we will add you to the notification list.
Questions about a specific vendor, a transfer mechanism, or a DPA copy? Email privacy@intelliprompter.com. We respond in writing within 30 days, usually faster.