Legal
Sub-processors
Archived version, published 13 October 2026 and replaced on 14 October 2026. The current version is at humfrid.com/legal.
Last updated October 13, 2026
This is the list of third parties that process Customer data on our behalf to provide Humfrid (Sub-processors under the DPA). Each is bound by data protection terms. Notice and objection rights for new Sub-processors are in DPA §4. Providers we use for our own website, sales and account administration are described in the Privacy Policy.
AI providers and your data
AI providers process Customer content only to provide the Services, under terms that do not allow them to train models on it. Some providers keep requests for a limited period for abuse and safety monitoring, and some cache inputs briefly to speed up responses, as their terms describe.
Current Sub-processors
AI model providers
| Sub-processor | Purpose | Data processed | Location | Terms |
|---|---|---|---|---|
| Anthropic, PBC | AI models for chat, reasoning, writing and agent work | Customer inputs and AI outputs | United States | Terms ↗ |
| Google LLC (Vertex AI and Gemini API) | AI models, text embeddings, voice | Customer inputs and AI outputs, embedding inputs, voice audio | United States and Google global infrastructure | Terms ↗ |
| OpenAI, OpCo, LLC | AI models for chat, agent work and classification | Customer inputs and AI outputs | United States | Terms ↗ |
| X.AI Corp | AI models for extraction and classification | Customer inputs and AI outputs | United States | Terms ↗ |
| TypeSafe AI, Inc. | AI model for structured classification | Customer inputs and AI outputs | United States | Terms ↗ |
Infrastructure
| Sub-processor | Purpose | Data processed | Location | Terms |
|---|---|---|---|---|
| Google LLC (Google Cloud) | Hosting, database, storage, queues, logging and analytics | All Customer data, encrypted at rest and in transit | United States | Terms ↗ |
| Google LLC (Firebase) | Sign-in and authentication | Names, email addresses, authentication tokens, phone numbers used for two-factor sign-in | United States | Terms ↗ |
| Cloudflare, Inc. | DNS, content delivery, network protection, web search, encrypted backup storage | Network metadata (IP addresses, request headers); web search queries; encrypted backup copies | Global network | Terms ↗ |
| Linkup (via Cloudflare) | Web search results for research features | Web search queries, which may contain names of companies or topics from a request | United States, European Union and other regions | Terms ↗ |
Messaging and voice
| Sub-processor | Purpose | Data processed | Location | Terms |
|---|---|---|---|---|
| Mailgun Technologies, Inc. (Sinch) | Sending and receiving email | Email addresses, message content, delivery metadata | United States | Terms ↗ |
| Twilio Inc. | SMS messages and phone calls | Phone numbers, message content, call audio | United States | Terms ↗ |
| Meta Platforms, Inc. (WhatsApp Business Platform) | WhatsApp messages, when a person chooses that channel | Phone numbers, message content | United States and Meta global infrastructure | Terms ↗ |
| LiveKit, Inc. | Real-time voice sessions | Voice audio during a session | United States | Terms ↗ |
Payments
| Sub-processor | Purpose | Data processed | Location | Terms |
|---|---|---|---|---|
| Stripe, Inc. | Payment processing and subscription billing | Billing contact details and payment details (card numbers are handled by Stripe) | United States | Terms ↗ |
Change log
Contact
To receive notice of changes, or for questions and objections: [email protected].