Subprocessors

The companies that process data for us

Each name links to that company's own privacy policy — that is the document that governs what it does with what it receives, and it is worth reading for the ones that get the most.

Two of them only ever appear if you choose them: signing in with Google or Facebook, and Google Analytics, which loads only if you accept the analytics category in the cookie banner. Say no and neither one gets anything.

If you do sign in, this is everything the provider sends us:

• Name, email address, and profile picture URL. What the provider hands us about you when you authorize the sign-in. We store the picture as a link to the provider, not a copy of the image.
• Whether the provider says that email is verified. A date, set by the provider. We never send our own verification email.
• Which provider it was, and the id that provider uses for you (the OAuth `sub`). This pair is what recognizes you on the next sign-in. There is no password here: we never create one, never ask for one, and never receive yours.
• When that sign-in expired, and what we asked the provider for. A timestamp, the word the provider uses for the kind of token it issued, and the list of things we asked it for — usually your name and email. This is the record of what was authorized in your name.
• The tokens the provider issues to complete the sign-in — which we do not keep. These are credentials to your Google or Facebook account, not to ours. We use them to finish the sign-in and discard them in the same step, so those fields stay empty: nothing here ever calls the provider again on your behalf. They never reach your browser, never appear in a log line, and are never sent to analytics.

Sending data out of the country

We are in Brazil, our servers are in Germany, and most of the companies above are in the United States, so your data does cross borders. The table says which company gets what, and where each one is; nothing leaves this site that is not in it.

For the document you paste, which is health information, what carries the transfer is your own decision to send it, after this page tells you it will be read by Anthropic in the United States and what for. Your account itself lives on servers in Germany, and Brazil's data protection authority has formally recognized the European Union as offering an adequate level of protection, so that leg rests on a public decision rather than on anything we had to arrange. For everything else — taking your payment, delivering your report — the transfer is carried by being necessary to do the very thing you asked us to do. Nothing crosses the border for a purpose of our own.

What this page does not claim: we accepted each of those companies' terms when we signed up, and terms like those usually carry a data protection agreement — but we have not gone provider by provider to confirm which document applies to us and since when. Until we have, this page will not tell you that a signed clause, a specific contract, or a certification is in place. Saying so without checking is the easy version, and it is the one nobody can verify.

If you want to know which agreement covers one of those companies, ask us: you get what we actually have, including the answer that we are still checking. The data protection address is [email protected].

How you find out when this list changes

This page is the list. A company that starts processing data for us is added here before it gets anything, and one that stops is removed here — the date at the top of this page is the day the text last changed.

A new company on this list changes what happens to your data, so it also becomes a new version of the privacy policy: the cookie banner comes back and asks you again, because the yes you gave before was given for a different list.

If you would rather be told than remember to check, every entry below is also published as an Atom feed your reader can follow. Following it costs you nothing and tells us nothing: no email address, no account, no sign-up. The subscription lives in your reader, so we never learn that you are watching this page.

Changes to this list (Atom feed)

We do not email you when this page changes, and we keep no list of people to email. Running that list would mean collecting your address for a new purpose and keeping it — and we are not going to ask you for an email so we can tell you about a page you can open, or follow without giving us anything.

Want to know whether anything changed, or why a company is on the list? Ask us at [email protected].

What changed, and when

Every change to the list above gets an entry here, newest first. The log starts on 2026-07-31, the day the list was first published — we are not going to write history for a list that did not exist yet.

1. 2026-08-21 — The checkout now carries a reference to the purchase itself we started sending more

   If you clicked the buy button more than once for the same bill, we opened more than one checkout, and each one created a row in our payments table. Until 2026-08-21 the confirmation Lemon Squeezy sends our server did not say WHICH of those rows you had actually paid, so we picked one by a rule — and the rule could pick the wrong one. Nobody was charged twice and every report was delivered, but our own record of the sale could point at the wrong attempt, and the page that shows you the state of your payment could be looking at a different attempt than the one that went through. From now on each checkout carries the id of its own row, both in the data we send Lemon Squeezy and inside the address your browser comes back to. That id is a random reference of ours: it opens nothing on their side, it says nothing about you, and it is stored on the same row of the same table as before — no new data about you, and no new retention period. We also started keeping their order number on that row, which is the number you would quote if you asked for a refund; before it only lived in our internal audit log.

2. 2026-08-20 — Your browser no longer contacts Google to load our fonts row corrected

   Until 2026-08-20 every page of this site loaded its typefaces from Google's font servers. That means your browser contacted Google on every visit — including the pages that show your bill analysis — and Google received your IP address and your browser's user agent. It happened whether or not you accepted anything in the cookie banner, because a font is not a script, and it was not described anywhere on this page. We are saying it plainly because it is the kind of thing a list of processors exists to say. The fonts are now stored on our own servers and are sent to you by us, so those requests to Google no longer happen at all. Google is still on this list for two other things, and both are your choice: signing in with Google, and Google Analytics if you accept the analytics category. Nothing about the site's look changed — same typefaces, same files.

3. 2026-08-20 — We now tell Lemon Squeezy where to send your browser back after you pay we started sending more

   Until now, paying left you on Lemon Squeezy's own confirmation page and your browser never came back to us. The checkout we open for you now includes the address of a page on our site that shows whether your report is ready. That address carries the id of the analysis you are paying for — the same reference we already sent them when the checkout opened — and nothing else: no email, no name, and no part of your analysis. The page it points to only shows the state of the payment; it never unlocks anything by itself, because only Lemon Squeezy's signed confirmation to our server does that.

4. 2026-08-19 — Google Analytics now also counts when a checkout starts we started sending more

   Until 2026-08-19 the only thing we sent to Google Analytics was page views, with the address already stripped of any identifier. From now on, if you accepted the analytics category, one action is counted as well: being sent to the payment page. It carries two values and no more — the currency and the price of the report, which is the same $12 printed on the page for everyone. Your name, your email, the id of your analysis and your document are not part of it, and cannot be: the values allowed to travel with an action are listed one by one in our code, and anything else is dropped before it leaves your browser. Nothing is sent if you did not accept analytics, and withdrawing your consent stops it immediately. No new company was added.

5. 2026-08-11 — Link parameters no longer reach Google Analytics row corrected

   Since 2026-08-05 this row said page addresses are sent without any identifier. That was true for the id of an analysis and not for the rest of the address: everything after the ? in a link was still sent. That included the one-time token in the links we email you to confirm an email change or an account deletion, so those tokens reached Google while they were still valid. Only browsers that had accepted the analytics category were affected. The product now removes everything after the ? before anything is sent, keeping only campaign tags (utm_...), and it does the same for the address of the page you came from. Nothing about your document or your analysis was ever sent, and no new company was added.

6. 2026-08-08 — We stopped sending your report email to the payment provider row corrected

   Since 2026-08-04 this row said we send Lemon Squeezy the email address you gave us to get your report, so their form comes prefilled. A security review found that the same address travelled whenever anyone opened a checkout for that analysis — a link to an analysis is enough to pay for it, and it does not have to be the person who ran it. We stopped reading that field at checkout: now the only thing we send them about you is the id of the analysis, plus an email address if the person paying types one at the payment step. They ask for an email on their own page when none is sent. Nothing else changed, and no part of your analysis has ever gone to them.

7. 2026-08-05 — This change log, and a feed you can follow published

   Until today this page told you the date it last changed, but not what changed. From now on every change to the list gets a dated entry here, and the same entries are published as a feed your reader can follow. Following it asks you for nothing: no email address, no account, no sign-up. Nothing about the list itself changed today.

8. 2026-08-05 — What Google Analytics receives, said exactly row corrected

   The row for Google said analytics receives page views. That was true and it hid the part that mattered: a page view carried the address of the page, and the address of an analysis page contains its id. The product now removes the id before anything is sent — an analysis page arrives as /analysis/[id] — and the row says so.

9. 2026-08-05 — The list got its own address published

   The list used to live only as a section inside the privacy policy. It now also has this page, at a short address you can link to and cite. No company was added or removed and no row was rewritten: the old links into the policy still work and still show the whole list.

10. 2026-08-04 — What we send to Lemon Squeezy when a checkout opens row corrected

    The row said Lemon Squeezy receives the payment details you type on their page. True, and incomplete: when the checkout opens we also send them the email address you typed to get your report, if you typed one, so their form comes prefilled, and the id of the analysis you are paying for. Neither is new — both have been sent since paid reports existed — and no part of your analysis ever goes to them. The row now says all of it.

11. 2026-07-31 — The list was first published, with seven companies published

    Anthropic, Lemon Squeezy, Cloudflare, Zoho (ZeptoMail), Hetzner, Google and Meta (Facebook), each with what it does for us, what it receives and the country it is in. This log starts here because the published list starts here: we are not going to write history for a list that did not exist yet.

Where this fits

This page is part of our Privacy Policy, which also carries this same list and explains what we keep, for how long, and how to ask us for it, correct it, or have it deleted. Older links to that section still work and still show the full list.