Section 1
Introduction
A sub-processor is a third-party service provider we engage to help us operate KleioBase - for example, hosting our database, running AI document processing, or sending transactional email. When a sub-processor handles personal data on our behalf, we remain responsible for that data and require the sub-processor to protect it under terms no less protective than our own commitments to you.
This page lists every sub-processor we use, and any we have given notice we will start using (their entry says from when). It is the list referenced by Section 7.1 of our Privacy Policy and by Annex III of our Data Processing Agreement, and we keep it up to date as our vendor list changes.
Section 2
Current sub-processors
| Provider | Purpose | Data shared | Location | Transfer safeguard | Processes your records |
|---|---|---|---|---|---|
| Supabase | Database hosting, authentication, file storage | All user data, uploaded documents, AI-extracted data | USA | Standard Contractual Clauses (SCCs) and DPA | Yes |
| Google (Gemini API) | AI document transcription and data extraction; Research Companion conversations, including files you attach directly to a conversation | Uploaded documents and processing context; images/PDFs attached to a Research Companion conversation | USA | EU-US Data Privacy Framework (certified) | Yes |
| TypeSafe AI, Inc. (Jev) | From 29 October 2026: second AI provider for two narrow yes/no checks: whether two recorded values, such as an occupation written in two languages or two spellings of a name, mean the same thing; and whether a message sent to the Research Companion is an attempt to manipulate the assistant. Used as a backup if our primary AI provider fails, and in its place once our primary AI provider's included capacity is used up. | For the first check, the two short recorded values being compared and their type (for example two spellings of a surname). For the second, the first 2,000 characters of your latest Research Companion message. No documents, account details or other profile data are sent. | USA | Standard Contractual Clauses (SCCs) and UK Addendum, under TypeSafe's DPA | Yes |
| Brave Search (Brave Software, Inc.) | Primary web-search provider for the AI Research Companion in production. Our self-hosted search service is used for overflow once the monthly Brave request budget is nearly exhausted, and as a fallback if Brave errors. | Search query text derived from your Research Companion request. No account details or uploaded documents are sent. | USA | Data Processing Addendum incorporating EU Standard Contractual Clauses | Yes |
| Freemius | Payment processing (Merchant of Record) | Email address, subscription status. Freemius independently collects and controls all payment details. We never receive or store card numbers, full billing addresses, or payment method details. Freemius does pass us the billing country and postal code with a completed purchase, which we do not store (see Section 3.1). | USA | DPA. Freemius acts as independent controller for payment processing. | No |
| Mapbox | Geocoding of locations extracted from records | Place names and addresses | USA | EU-US Data Privacy Framework (certified) | Yes |
| PostHog | Product analytics, masked session replay (only after you consent to analytics), and AI performance monitoring | Usage data, device info, AI request metadata (model, token counts, latency, cost), and product events recorded by our servers (counts, categories and plan details, never names, record contents or file names). Once you consent to analytics, your account identifier and email address are sent as well, so product usage can be tied to your account; if you decline, browser capture is cookieless and product events recorded by our servers carry a random one-off identifier, so neither carries a persistent identifier. Developer API and AI assistant calls are the one exception: they carry an identifier that lasts a single day, made from a secret that is replaced daily, so one working session is counted as one session. Only if you make a choice and consent to analytics, masked session replays are also recorded: form inputs are masked, all text inside your account and on shared pages is masked, record images, uploaded documents and photos are never captured, and replays are deleted after 30 days. Prompts and AI responses are never sent. On the Get started page, the screens reached and the non-ancestry answers carry a random identifier for that visit only (linked to your account only with analytics consent); the answers about where your family is from and which languages your records are in are sent by our servers with no identifier at all. | USA | EU-US Data Privacy Framework (certified) and SCCs; consent-based | No |
| Resend | Transactional and marketing email delivery; receives inbound mail to role addresses (privacy@, contact@, support@, abuse@, security@, legal@, marketing@) and forwards it to our application via webhook | Email addresses, your first and last name if you gave them on our Get started page, email content (outbound and inbound), and the acquisition channel that brought you to sign up (for example, "organic_search" or "meta_ads"), stored as a contact property so we can segment and measure marketing performance. Only the derived channel label is shared, never the underlying UTM parameters, click identifiers, or referrer. | USA | EU-US Data Privacy Framework (certified) and SCCs | Yes |
| Meta (Facebook Pixel and Conversions API) | Marketing analytics and advertising | Page views and conversion events (sign-up, pricing page view, checkout start, subscription, purchase, and your first confirmed record), plus the details Meta uses to match an event to an advertising click: your email address, your account identifier, your first and last name, the Meta browser cookies (_fbp and _fbc), your IP address and browser user-agent, and, for a purchase, the billing country and postal code, the amount and currency, and the transaction reference. Your first and last name, email address, country and postal code are hashed before transmission. Your account identifier, the _fbp and _fbc cookie values, your IP address and your browser user-agent are sent in the clear, because Meta matches them in that form. We do not send your phone number, street address, uploaded documents, or any genealogy data. Nothing is sent unless you have consented to marketing cookies. | USA | EU-US Data Privacy Framework (certified); consent-based | No |
| TikTok (TikTok Pixel and Events API) | Marketing analytics and advertising | Page views (including the page address) and conversion events (sign-up, pricing page view, checkout start, waitlist sign-up, subscription, purchase, and your first confirmed record), plus the details TikTok uses to match an event to an advertising click: your email address, your account identifier, the TikTok browser cookie (_ttp), the TikTok click identifier from the advertising link you arrived on (ttclid), your IP address and browser user-agent, and, for a purchase, the amount and currency, the plan name and the transaction reference. Your email address and account identifier are hashed before transmission. The _ttp cookie value, the click identifier, your IP address and your browser user-agent are sent in the clear, because TikTok matches them in that form. We do not send your name, phone number, billing address, uploaded documents, or any genealogy data. Nothing is sent unless you have consented to marketing cookies. | USA and other countries where TikTok operates | Standard Contractual Clauses under TikTok's Business Products (Data) Terms; consent-based | No |
| Railway | Application hosting and deployment | IP address, request data (server logs) | USA | DPA and SCCs | Yes |
| Sentry | Error monitoring, performance tracking, and masked session replay (only after you consent to analytics) | Error reports, which may include your account identifier (a random ID, never your name or email), IP address, browser info, and application state at the time of an error; and, only if you consent to analytics, masked session replays (a reconstruction of page interactions - clicks, navigation, and DOM changes - with all text and form inputs masked) recorded for a sample of sessions and on errors, buffered in your browser's sessionStorage | USA | EU-US Data Privacy Framework (certified) and SCCs | Yes |
| incident.io | Incident management and on-call alerting; receives error and uptime alerts forwarded from Sentry so we can coordinate our response to outages and significant errors | Error and incident metadata forwarded from Sentry (error type, affected endpoint, and timestamps), which may include an IP address or user identifier embedded in an error’s context | United Kingdom (provider); data stored in the EU/EEA (Google Cloud European regions) | Data Processing Addendum; EU/UK adequacy decision (for EU/EEA-origin data) plus EU Standard Contractual Clauses and the UK Addendum for the provider's onward US sub-processors | No |
| Linear | Product issue tracking and triage of feedback you submit through the in-app feedback form | Your email address and the feedback content you submit (description, steps to reproduce, and any screenshot you attach) | USA | DPA and SCCs | No |
| Chativox | AI-powered in-app customer support chat, operated by the same sole proprietor who operates KleioBase - it is our own support system rather than an outside company, run on separate infrastructure. Replies are generated using Google's Gemini AI. You control when to start a conversation, and conversations are retained for up to 12 months (deletion available on request). | Your account identifier, name, email address, and plan tier (sent to identify you in the chat), plus the messages and any details you choose to share in the support conversation | United States (support-chat hosting, AI replies, and service email); global edge network (content delivery) | Operated by the same sole proprietor as KleioBase, so support-chat data is not disclosed to another company; the underlying providers are covered by the EU-US Data Privacy Framework and Standard Contractual Clauses, as listed separately in this table | No |
| Cloudflare (CDN + Turnstile + Email Routing + media hosting + access blocking) | Content delivery network (CDN) and reverse proxy in front of the entire site, terminating TLS at the edge and routing every request to our application; bot protection on forms; inbound email routing (forwards mail sent to our role addresses - e.g. privacy@, support@, contact@ - to our email provider); hosting of static site media, such as the onboarding walkthrough video, on Cloudflare R2; and access blocking, using a Cloudflare Worker and a Cloudflare Workers KV store that hold the list of visitors blocked from the site for abuse or harassment, so a block is enforced at the edge before the request reaches us | Every request to the site passes through Cloudflare's network, including your IP address, browser user-agent, and the URL requested. For signed-in sessions, the page content itself - including knowledge-base records, person profiles, and Research Companion conversations - transits their network in the course of serving the page. Cloudflare also handles browser interaction data for bot challenges on forms (processed transiently), and, for email routing, the sender address and message content of mail you send to our role addresses. For access blocking, the Worker reads each request's IP address and the abuse-prevention cookie described in Section 10 and compares them against the block list held in Cloudflare Workers KV; that store contains only blocked IP addresses and blocked cookie identifiers, so nothing is written to it about a visitor who has not been blocked. We also read aggregate bot-traffic analytics back from Cloudflare about our own site's traffic, such as crawler request counts - this describes our site's traffic, not anything additional about you. Static media hosting shares no personal data - the files served are fixed marketing assets, not customer content. | Global | EU-US Data Privacy Framework (certified) | Yes |
| Google, GitHub (OAuth) | Single sign-on authentication | Profile data you authorize during sign-in (email, name, avatar) | USA | EU-US Data Privacy Framework (Google); DPA (GitHub/Microsoft) | No |
Provider logos above are the trademarks of their respective owners, shown only to identify each sub-processor and not to imply any endorsement or affiliation.
Only the providers marked Yes in the Processes your records column process Customer Content - your uploaded documents, extracted genealogical data, profiles, and Research Companion conversations - and are sub-processors under our Data Processing Agreement. The providers marked No handle only account, billing, analytics, or support data, where KleioBase acts as an independent controller rather than as your processor.
Section 3
Change history
We record every addition, removal, or material change to our sub-processor list here, most recent first.
- 2026-10-20addedTikTok (TikTok Pixel and Events API)
Advertising measurement for TikTok ads, working the same way as our existing Meta measurement: the TikTok Pixel in your browser and a server-side copy of the same conversion events. It only runs if you consent to marketing cookies, and the cookie banner now names TikTok, so everyone is asked again. TikTok never receives uploaded documents, genealogy data or your name; your email address and account identifier are hashed before they are sent.
- 2026-10-03changedTypeSafe AI, Inc. (Jev)
TypeSafe, already announced to start on 29 October 2026, will also help with one more narrow check from that date: whether a message sent to the Research Companion is an attempt to manipulate the assistant. For this it receives only the first 2,000 characters of that message, never your account details, documents or knowledge base. TypeSafe will also act as a backup if our primary AI provider fails, not only once that provider's included capacity is used up. Nothing is sent to TypeSafe before 29 October 2026. This is an existing sub-processor under an existing agreement; it processes data in the USA under Standard Contractual Clauses and does not train models on it.
- 2026-09-29addedTypeSafe AI, Inc. (Jev)
From 29 October 2026, TypeSafe may answer one narrow question for us: whether two recorded values, such as an occupation written in two languages or two spellings of a surname, mean the same thing. It only receives those two short values and their type, never documents or account details. It is used only when our primary AI provider's included capacity is used up. TypeSafe processes data in the USA under Standard Contractual Clauses and does not train models on it.
- 2026-09-15changedPostHog
PostHog, already our product analytics provider, now also records masked session replays, but only for visitors who make a choice and consent to analytics. Form inputs are always masked, all text inside your account and on shared pages is masked, and record images, uploaded documents and photos are never captured. Replays are deleted after 30 days. This is an existing sub-processor under an existing agreement.
- 2026-09-09changedCloudflare (CDN + Turnstile + Email Routing + media hosting + access blocking)
Cloudflare, already the content delivery network in front of the whole site, now also enforces our access blocks. A small program running on Cloudflare's network checks each request against a list of visitors we have blocked for abuse or harassment, held in a Cloudflare Workers KV store, and stops a blocked request before it reaches us. The list contains only blocked IP addresses and blocked identifiers; nothing is stored there about a visitor who has not been blocked. This is an existing sub-processor under an existing agreement, and no new category of data leaves us. The cookie that carries the identifier is described in Section 10 of our Privacy Policy.
- 2026-09-09changedChativox
Corrects two things about the in-app support chat, neither of which changes what happens to your data. First, Chativox is operated by the same sole proprietor who operates KleioBase - it is our own support system running on separate infrastructure, not an outside company we hand your details to. Second, this entry previously said the support chat's data sits in Israel; Israel is where we are established, and the support conversations are actually stored in the United States, with AI replies from Google and service email from Resend also in the United States, delivered through a global edge network. Both providers already appear in this table in their own right. Nothing about the data we share, how long it is kept (12 months), or your ability to have it deleted has changed.
- 2026-09-03changedCloudflare (CDN + Turnstile + Email Routing + media hosting)
Corrects this entry to describe Cloudflare's role as the content delivery network and reverse proxy in front of the entire site, including the authenticated product. This has always been how the site is served; nothing about the processing changed, only the disclosure. Because signed-in page content, including Customer Content such as knowledge-base records, person profiles, and Research Companion conversations, transits Cloudflare's network in the course of serving each page, Cloudflare now also appears in DPA Annex III. We also now disclose that we read aggregate bot-traffic analytics back from Cloudflare about our own site's traffic; that is traffic metadata about crawlers, not anything additional about a user.
- 2026-08-28changedCloudflare (CDN + Turnstile + Email Routing + media hosting)
Cloudflare now also hosts static site media, such as the onboarding walkthrough video, on Cloudflare R2. This is an existing sub-processor whose account-wide DPA already covers the service; the media hosted there carries no personal data and no customer content, so nothing new is disclosed about you.
- 2026-08-06changedGoogle, GitHub (OAuth)
Apple removed from this entry. Sign in with Apple was listed at first publication but never enabled, so no data was ever shared with Apple.
- 2026-07-14addedMeta (Conversions API)
Server-side advertising measurement. Consent-gated; fires only where marketing consent is granted.
- 2026-06-08addedInitial register
Sub-processors in place at first publication of the privacy policy.
Section 4
Get notified of changes
Sign up below to be notified by email whenever we add a new sub-processor or make a material change to this list.
Section 5
Contact us
Questions about a specific sub-processor or how we use it? Email us at privacy@kleiobase.com.