● Legal
Subprocessors
Last updated 9 subprocessors
The short version
- A subprocessor is a company we use to run Tinu that ends up handling data on our behalf. Every one of them is named below. There are no unnamed “trusted partners.”
- We email organization admins at least 30 days before a new subprocessor begins processing your data, so there is time to object. Urgent security replacements are the one exception, covered in section 03.
- Every change to this list is written down, with the date, in the change log at the bottom of this page.
This page is part of our Privacy Policy and our Data Processing Agreement.
Current subprocessors
These are the third parties we engage as subprocessors to process Customer Personal Data on your behalf. Each is bound by a data processing agreement with us. Section 02 lists the services you connect yourself, so you can tell the two relationships apart.
| Subprocessor | Purpose | Data reaching them |
|---|---|---|
| Vercel | Application hosting and delivery | All request traffic, IP addresses |
| Neon | Primary database | Account data, workspace content |
| Upstash | Caching, rate limiting, session revocation | Session and rate-limit keys, IP addresses |
| Inngest | Background job orchestration | Job payloads referencing workspace content |
| OpenAI | Summaries, chat answers, embeddings | Workspace content submitted to the model |
| Summaries and extraction (Gemini) | Workspace content submitted to the model | |
| Resend | Transactional and notification email | Name, email address, message content |
| Sentry | Error monitoring | Error traces, which may incidentally contain content |
| PostHog | Product analytics | Usage events, IP address, account identifiers, autocaptured element text |
Our infrastructure and subprocessors are primarily US-based. Section 10 of the Privacy Policy covers international transfers, including the Standard Contractual Clauses we rely on.
Integrations you connect
These are the services your organization can connect today, under your own agreement with that provider. We read from them with your admin’s authorization and within the scope you grant. We do not engage them, and your agreement with them, not ours, governs what they do with your data.
| Integration | Purpose | Data reaching them |
|---|---|---|
| Slack | Integration, where your organization enables it | Messages and identities within the granted scope |
How we tell you about changes
Before a new subprocessor begins processing Customer Personal Data, we email your organization’s admins at least 30 days in advance. That notice period is the window to raise an objection, and it is a commitment in section 13 of the Privacy Policy and section 07 of the Data Processing Agreement, not a courtesy.
One exception. If a subprocessor has to be replaced quickly for security, legal or service-continuity reasons, we may act before the 30 days have run and notify you as soon as reasonably practicable. Your objection right is unchanged. Without that carve-out, a serious incident at a hosting provider would force us to choose between breaking this promise and fixing the problem.
This page is the public record. Every change lands in the log below on the day it takes effect, so you can check the current list at any time without asking us, and bookmark one URL for a vendor review.
Not a customer yet, or want the notice sent somewhere else? Email privacy@tinuai.com with the address to use, and we will add it to the notification list for this page.
Change log
| Date | Change |
|---|---|
| This page published, with nine subprocessors. Nothing was added and nothing new began processing your data, so no notice was owed. The same third parties were previously listed in section 06 of the Privacy Policy, with one change of classification: Slack is now shown separately as an integration your organization connects under its own agreement with Slack, rather than as a subprocessor we engage. |
Contact us
See also our Privacy Policy, Data Processing Agreement and Terms of Service, or return to the Tinu AI home page.