Sub-
processors

These companies process personal data for Cuiar under contracts that limit them to our instructions. Cloudflare, netcup, Backblaze and OpenRouter, with OpenRouter's model providers, get the data of Team customers: they are the sub-processors of the Data Processing Agreement. Stripe and Zoho Mail get only our own billing and mail data. We change this page at least 30 days before a new sub-processor starts, and we tell Team owners by e-mail.

Cloudflare

• Company: Cloudflare, Inc.
• What it does: Hosts cuiar.com, protects and carries the traffic to our API, sends our e-mail, receives the mail of the e-mail channel, and stores task files and hand-off workspaces.
• Data: All data that goes to the site and the API, e-mail addresses and messages, task files.
• Where: USA; global network. Task files: Western Europe.
• Transfer safeguard: Standard Contractual Clauses with the UK Addendum, in Cloudflare's data processing addendum.

netcup

• Company: netcup GmbH
• What it does: Runs the servers of our API and database.
• Data: All data that the API keeps.
• Where: Germany (Nuremberg).
• Transfer safeguard: In the EU. No transfer.

Backblaze

• Company: Backblaze, Inc.
• What it does: Keeps daily backups of our database for 30 days.
• Data: All data that the API keeps.
• Where: EU region (Amsterdam, Netherlands).
• Transfer safeguard: Stored in the EU.

Stripe

• Company: Stripe, Inc. and Stripe Payments Europe, Ltd.
• What it does: Card payments, invoices and the billing portal. For fraud checks and its own legal duties, Stripe is a separate controller.
• Data: E-mail address, account ID, plan, payment details that you give Stripe.
• Where: USA and Ireland.
• Transfer safeguard: Standard Contractual Clauses with the UK Addendum, in Stripe's data processing agreement.

OpenRouter

• Company: OpenRouter, Inc.
• What it does: Sends each request of the agent to one of the model providers below. We ask for zero data retention: the provider keeps no request data and does not train on it.
• Data: Your task and messages, the text of the pages that the agent reads, earlier results, up to 12 memories, and an anonymous ID in place of your account.
• Where: USA.
• Transfer safeguard: Standard Contractual Clauses (Module 2) with the UK Addendum, in OpenRouter's data processing agreement.

Zoho Mail

• Company: Zoho Corporation
• What it does: The mailbox that receives mail to support@cuiar.com, contact@cuiar.com and security@cuiar.com.
• Data: The mail that you send to us.
• Where: USA.

Model providers

OpenRouter sends each request of the Cuiar agent to one of these providers, as its own sub-processors. We ask for zero data retention, so each one keeps no request data and does not train on it.

• DeepInfra: USA
• Fireworks AI: USA
• Together AI: USA
• Nebius: Netherlands
• Google Cloud (Vertex AI): USA

Not sub-processors

These get data as their own controllers, under their own terms:

• NOWPayments (FD Transfers LLC, Saint Vincent and the Grenadines): Takes crypto payments on its own payment page. We send it the order number and the price only. It is a separate controller for what you give it there. The transfer is necessary for the payment that you ask for (GDPR Art. 49(1)(b)).
• Telegram and Slack: Only when you connect them as a channel: they carry your messages to and from Cuiar under their own terms.
• IP location services (get.geojs.io, ipinfo.io, ipwho.is, ipapi.co): The browser on your computer asks one of them for the location of a workspace's IP address, through that workspace's proxy, to set its time zone and language. The service sees that IP address. We do not get the answer.
• Authorities and courts: Only when a law makes it necessary.

Contact

To get notices of changes, or to object to a new sub-processor, write to contact@cuiar.com.