Version 2026-10-20 · effective [[TO FILL: effective date]]
Subprocessors
The companies that process personal data to run Tidal AI for us, what each one does, and where.
These are the service providers ("subprocessors") that may process personal data when you use Tidal AI. Each is bound by a data processing agreement with us. We tell customers about new subprocessors [[TO FILL: notice period, e.g. 30 days]] before they start processing their data; to be notified, [[TO FILL: how to subscribe to subprocessor updates]].
Infrastructure
| Provider | What it does for us | Data | Location | Transfer safeguard |
|---|---|---|---|---|
| Fly.io, Inc. | Runs the Tidal AI app and API, and the isolated machines that run your bots' code and the apps they deploy | All service data in transit and in memory; code and files in bot machines | [[TO FILL: Fly regions used, e.g. London (lhr)]]; company in the United States | [[TO FILL: DPF / SCCs + UK Addendum]] |
| Neon, Inc. (on Amazon Web Services) | Our database | Account, workspace content, usage, logs | AWS eu-west-2 (London, UK); company in the United States | [[TO FILL: DPF / SCCs + UK Addendum]] |
| [[TO FILL: Tigris Data, Inc., or the production object store]] | Stores files: drive files, build outputs, screenshots, artifacts | Files you and your bots create or upload | [[TO FILL: region]] | [[TO FILL: safeguard]] |
AI models
| Provider | What it does for us | Data | Location | Transfer safeguard |
|---|---|---|---|---|
| OpenRouter, Inc. | Routes each request to the AI model you or your bot chose | The conversation and the context a bot needs for that step; a pseudonymous identifier (a keyed hash of the workspace id, never a name or email) for abuse tracing; the name and web address of the app ("Tidal AI") as app attribution | United States | [[TO FILL: DPF / SCCs + UK Addendum]] |
| Model providers, reached through OpenRouter: Anthropic, OpenAI, Google, Meta (Llama, via hosting providers), Mistral, xAI, DeepSeek, Qwen (Alibaba), Moonshot, Z.ai, MiniMax, Cohere, Amazon, Microsoft, NVIDIA, Perplexity, ByteDance Seed, and the inference hosts that serve their models | Generate the bot's answer | The same request, processed only to answer it. We request providers that do not retain prompts or train on them | United States and other countries depending on the model and host [[TO FILL: list countries, or restrict routing]] | [[TO FILL: per provider]] |
If you add your own model provider key, requests on that key go directly to that provider under your own agreement with them; it is not our subprocessor for that traffic.
Communications
| Provider | What it does for us | Data | Location | Transfer safeguard |
|---|---|---|---|---|
| Resend (Resend, Inc.) | Sends sign-in emails, account notices and the email your bots send; receives email for bot mailboxes | Email addresses, message content and attachments | United States | [[TO FILL: DPF / SCCs + UK Addendum]] |
| Browser push services: Google (Firebase Cloud Messaging), Mozilla, Apple, Microsoft | Deliver push notifications to devices where you turned them on | A device token and a short notice (headline and link only) | Varies by browser maker | [[TO FILL: safeguard]] |
Sign-in (only if you choose them)
| Provider | What it does | Data | Location |
|---|---|---|---|
| Google LLC | "Continue with Google" sign-in | Your Google account's email, name and picture | United States |
| GitHub, Inc. | "Continue with GitHub" sign-in | Your GitHub account's email, name and avatar | United States |
Payments
| Provider | What it does | Data | Location |
|---|---|---|---|
| Stripe Payments Europe, Ltd. and Stripe, Inc. [[TO FILL: confirm which Stripe entity contracts with us]] | Takes payment for credits on its own hosted page, sends your receipt, handles refunds, disputes and fraud screening, and keeps a card you ask us to save for automatic top-ups | You enter your card and billing details on Stripe's page; we never see them. Stripe receives your email address, the amount and currency, and our reference. We receive back the amount, currency, a receipt link, the brand and last four digits of a saved card, and refund and dispute status | Ireland and the United States [[TO FILL: confirm Stripe's transfer safeguards]] |
Stripe also acts as an independent controller for some of this data (for example fraud prevention and its own legal duties); see Stripe's privacy policy.
Optional and future providers
| Provider | When | Notes |
|---|---|---|
| [[TO FILL: hosted browser provider, if BROWSER_WS_ENDPOINT is used in production]] | If bots' web browsing runs on a hosted browser service | Pages a bot visits and screenshots of them |
| Expo (650 Industries, Inc.) | Only if you connect your own Expo account to build mobile apps | Your project's code, sent with your own token |
Not subprocessors
Services you connect to your workspace (your email account, databases, APIs, MCP servers, file servers, and the out-of-the-box news, Wikipedia, Hacker News, weather and DeepWiki connectors) receive what your bots send them because you or your bots chose to use them. They act under their own terms, not on our behalf.