Sub-processors
A "sub-processor" is a third-party service that processes your personal data on our behalf to run Perspicuity. This page lists everyone in that group, what we send them, and where they sit. It is the canonical source — we update it when something changes.
We sign each sub-processor's standard Data Processing Agreement (or equivalent) before sending traffic. Sub-processors outside Canada rely either on the EU–US Data Privacy Framework (Anthropic, Google, Resend) or Standard Contractual Clauses.
| Sub-processor | Purpose | Data sent | Location |
|---|---|---|---|
| Hetzner Online GmbH | Infrastructure — VPS hosting (database, application server, error monitor, identity provider). | Everything (we are a guest on their machines). | Germany (Falkenstein/Nuremberg). |
| Anthropic | Large-language-model API (Claude family). | Conversation content, system prompt, and decision artifacts whenever the agent is talking. No model training; 7-day abuse-monitoring retention. | United States (DPF-certified). |
| Google (Gemini API) | Large-language-model API (Gemini family, alternative tier). | Same as Anthropic. Paid-tier no-training; Zero-Data-Retention configured where supported. | United States (DPF-certified). |
| Deepgram | Speech-to-text transcription (voice mode only). | Audio you speak when voice mode is enabled. | United States. |
| Resend | Transactional email (invite, welcome, account notifications). | Recipient email, subject, body of the message. | United States (DPF-certified). |
| Helcim | Payment processing (credit purchases). | Card details (handled directly by Helcim; we receive only the last 4 digits, transaction ID, and approval code). | Canada (Calgary, AB). |
| Cloudflare | DNS and edge traffic management. | Request metadata (IP, host, path) — we do not put a Cloudflare proxy in front of authenticated traffic by default. | Global (anycast network). |
| Keycloak (self-hosted) | Identity and sign-in (OIDC). | Your email, name, and identity-provider sub. Hosted on our own Hetzner machine. | Germany (same machine as Perspicuity). |
| GlitchTip (self-hosted) | Error monitoring. | Stack traces and request metadata when something breaks. Hosted on our own Hetzner machine. | Germany (same machine as Perspicuity). |
How we notify you of changes
If we add a new sub-processor that handles your decision content, we update this page before sending data to them, and we email every active member. You can object by closing your account. If we replace one in the same category (e.g. switching email providers), we update this page and surface the change in-product.
Contact
Questions or objections — privacy@peopleandplanet.consulting.