Subprocessors

This list identifies the core providers Annot8 may use to process customer personal data. Actual use depends on the features and integrations a customer enables. Vendor locations, affiliates, and downstream subprocessors can change under their published terms; customers should review the linked vendor materials during procurement.

• Clerk — authentication, account identity, organizations, and session security — United States/global infrastructure — clerk.com/legal/dpa and clerk.com/legal/subprocessors
• Convex — database, server functions, scheduled jobs, realtime synchronization, and file storage — United States/global infrastructure — convex.dev/legal/dpa and convex.dev/security
• Vercel — web hosting, content delivery, server execution, AI Gateway, Workflow, Sandbox, and operational logs — United States/global infrastructure — vercel.com/legal/dpa and security.vercel.com
• OpenAI — AI classification, generation, screenshot analysis, media transcription, and proposed code fixes routed through Vercel AI Gateway when enabled — United States/global infrastructure — openai.com/policies/data-processing-addendum and openai.com/policies/sub-processor-list
• Resend — transactional and notification email delivery — United States/global delivery infrastructure — resend.com/legal/dpa and resend.com/legal/subprocessors
• Polar — merchant of record, checkout, subscriptions, orders, tax, and payment metadata — Europe/United States and its providers — polar.sh/legal/data-processing-addendum and polar.sh/legal/checkout-buyer-terms
• Google Analytics — consent-gated website acquisition, page-view, funnel, and web-vitals measurement when configured — Google infrastructure — business.safety.google/adsprocessorterms and privacy.google.com/businesses/subprocessors
• PostHog — consent-gated product analytics events when configured; Annot8 disables autocapture and session replay — selected US or EU project region — posthog.com/docs/privacy and posthog.com/docs/privacy/dpa
• Browser push services — delivery of web-push notifications to a subscribed browser — provider and location depend on the visitor's browser/device

Slack, Linear, Jira/Atlassian, Asana, Discord, Microsoft Teams, Trello, GitHub, GitLab, email recipients, and custom webhooks are activated and configured by the customer. They receive data under the customer's instructions and may be the customer's independent processor or controller rather than an Annot8 subprocessor. Customers are responsible for destination contracts, permissions, notices, and deletion requests.

Where required for a restricted transfer, Annot8 and the relevant provider use an applicable adequacy decision, EU Standard Contractual Clauses, UK Addendum or IDTA, or another recognized mechanism, together with supplementary safeguards where appropriate. The exact transfer schedule must be completed in the customer's executed DPA/order documentation.

A customer that requires advance notice of a new subprocessor should register a legal or privacy contact through its order form or email privacy@annot8.app. Contractual notice and objection periods are governed by the executed DPA. An objection must explain the reasonable data-protection concern so the parties can evaluate an alternative or termination of the affected feature.