Sub-Processors | Groundwork

Groundwork (operated by Ivy & Rill Consulting Inc.) uses the sub-processors below to operate the Service. A sub-processor is a company that processes personal information on our behalf so we can deliver Groundwork to you. We update this page before we add a new sub-processor.

For background on how we collect, use, and share data, see the Privacy Policy.

Vendor	Purpose	Data categories	Region	Safeguards
Anthropic, PBC	AI inference for the Scout assistant and other AI-powered features (Claude models)	Scout prompts and AI-generated responses; business operational data included in prompts	United States	Data Processing Agreement executed. Anthropic does not use API content to train its models. Standard Contractual Clauses available for EEA/UK transfers.
Hangzhou DeepSeek Artificial Intelligence Basic Technology Research Co., Ltd. (DeepSeek API)	Scout AI inference — processes Scout prompts and generates AI responses for selected request types	Scout text inputs (user queries to Scout); AI-generated outputs; business operational data included in prompts	People’s Republic of China — Hangzhou	Disclosure and consent in Privacy Policy (PIPEDA Principles 1, 4.3, and 4.8). No Data Processing Agreement executed (none offered by DeepSeek). No Standard Contractual Clauses or adequacy decision available. Chinese state-access risk (National Intelligence Law 2017, Cybersecurity Law 2017, Data Security Law 2021) explicitly disclosed in Privacy Policy. EU users excluded from DeepSeek routing via geo-gate.
Supabase Inc.	Cloud database, authentication, and storage for account, learning progress, and product data	Account information (name, email, hashed password); learning progress and usage data; user-generated content saved in the product	United States	Data Processing Agreement executed (Supabase Module 2 DPA). Standard Contractual Clauses for EEA/UK transfers. Row-level security enforced at the database layer.
Stripe, Inc.	Subscription billing and payment processing	Billing name, last four digits of card, transaction identifiers, subscription status	United States	Data Processing Agreement executed. EU-US Data Privacy Framework adequacy decision (Commission Implementing Decision 2023/1795); Standard Contractual Clauses for transfers from the UK and Switzerland (see stripe.com/legal/dpa).
Google LLC	Google Analytics 4 (usage analytics, consent-gated) and Google Ads (advertising measurement, consent-gated)	IP address (anonymized), device and browser type, page interactions; advertising identifiers if marketing cookies are accepted	United States	Data Processing Terms executed (Google Ads DPT + GA4 DPA). EU-US Data Privacy Framework adequacy decision (Commission Implementing Decision 2023/1795); UK Extension to the DPF. Set only after the visitor consents to the relevant cookie category.
Meta Platforms, Inc.	Meta Pixel and Conversions API for advertising measurement (consent-gated)	Hashed email or phone (SHA-256 before transmission), event data, advertising identifiers	United States	EU-US Data Privacy Framework adequacy decision (Commission Implementing Decision 2023/1795); UK Extension to the DPF. Set only after the visitor consents to marketing cookies. Personal identifiers are SHA-256 hashed before they leave our servers.
Resend	Transactional and account email delivery (sign-up confirmations, password resets, receipts)	Recipient email address, email subject and body, delivery metadata	United States	Data Processing Agreement executed. Standard Contractual Clauses for EEA/UK transfers.
Vercel Inc.	Application hosting and edge delivery	Standard request metadata (IP address, user agent, request path) for delivery and abuse prevention	United States (multi-region edge)	Data Processing Agreement executed. Standard Contractual Clauses for EEA/UK transfers.

Vendor: Anthropic, PBC
Purpose: AI inference for the Scout assistant and other AI-powered features (Claude models)
Data categories: Scout prompts and AI-generated responses; business operational data included in prompts
Region: United States
Safeguards: Data Processing Agreement executed. Anthropic does not use API content to train its models. Standard Contractual Clauses available for EEA/UK transfers.
Vendor: Hangzhou DeepSeek Artificial Intelligence Basic Technology Research Co., Ltd. (DeepSeek API)
Purpose: Scout AI inference — processes Scout prompts and generates AI responses for selected request types
Data categories: Scout text inputs (user queries to Scout); AI-generated outputs; business operational data included in prompts
Region: People’s Republic of China — Hangzhou
Safeguards: Disclosure and consent in Privacy Policy (PIPEDA Principles 1, 4.3, and 4.8). No Data Processing Agreement executed (none offered by DeepSeek). No Standard Contractual Clauses or adequacy decision available. Chinese state-access risk (National Intelligence Law 2017, Cybersecurity Law 2017, Data Security Law 2021) explicitly disclosed in Privacy Policy. EU users excluded from DeepSeek routing via geo-gate.
Vendor: Supabase Inc.
Purpose: Cloud database, authentication, and storage for account, learning progress, and product data
Data categories: Account information (name, email, hashed password); learning progress and usage data; user-generated content saved in the product
Region: United States
Safeguards: Data Processing Agreement executed (Supabase Module 2 DPA). Standard Contractual Clauses for EEA/UK transfers. Row-level security enforced at the database layer.
Vendor: Stripe, Inc.
Purpose: Subscription billing and payment processing
Data categories: Billing name, last four digits of card, transaction identifiers, subscription status
Region: United States
Safeguards: Data Processing Agreement executed. EU-US Data Privacy Framework adequacy decision (Commission Implementing Decision 2023/1795); Standard Contractual Clauses for transfers from the UK and Switzerland (see stripe.com/legal/dpa).
Vendor: Google LLC
Purpose: Google Analytics 4 (usage analytics, consent-gated) and Google Ads (advertising measurement, consent-gated)
Data categories: IP address (anonymized), device and browser type, page interactions; advertising identifiers if marketing cookies are accepted
Region: United States
Safeguards: Data Processing Terms executed (Google Ads DPT + GA4 DPA). EU-US Data Privacy Framework adequacy decision (Commission Implementing Decision 2023/1795); UK Extension to the DPF. Set only after the visitor consents to the relevant cookie category.
Vendor: Meta Platforms, Inc.
Purpose: Meta Pixel and Conversions API for advertising measurement (consent-gated)
Data categories: Hashed email or phone (SHA-256 before transmission), event data, advertising identifiers
Region: United States
Safeguards: EU-US Data Privacy Framework adequacy decision (Commission Implementing Decision 2023/1795); UK Extension to the DPF. Set only after the visitor consents to marketing cookies. Personal identifiers are SHA-256 hashed before they leave our servers.
Vendor: Resend
Purpose: Transactional and account email delivery (sign-up confirmations, password resets, receipts)
Data categories: Recipient email address, email subject and body, delivery metadata
Region: United States
Safeguards: Data Processing Agreement executed. Standard Contractual Clauses for EEA/UK transfers.
Vendor: Vercel Inc.
Purpose: Application hosting and edge delivery
Data categories: Standard request metadata (IP address, user agent, request path) for delivery and abuse prevention
Region: United States (multi-region edge)
Safeguards: Data Processing Agreement executed. Standard Contractual Clauses for EEA/UK transfers.

Notice of changes

We will update this page when we add, remove, or change a sub-processor. Material changes to AI sub-processors (for example, adding a new AI model provider in a new jurisdiction) will also be reflected in the Privacy Policy.

Contact

Questions about a sub-processor or how your data is processed? Email privacy@groundwork.cafe.