← All documents

List of sub-processors

Version 1.0 · Effective from 2026-09-15

1. Current sub-processors

This list forms an annex to the Data Processing Agreement and names the entities the Operator engages to process personal data in connection with providing the Service. It covers both data for which the Operator is a controller and data entrusted to it by the Client.

EntityRoleLocationTransfer basis
H88 S.A. (cyberFolks)hosting of the application server and databasePolandprocessing within the EEA — no basis required
Cloudflare, Inc.reverse proxy, web application firewall, DNS, and backup storage (R2)United States / globalstandard contractual clauses and the EU–US Data Privacy Framework
OpenRouter, Inc.gateway to language models — transmitting request content and receiving responsesUnited Statesstandard contractual clauses
Resend, Inc.transactional email (address verification, password resets, notifications)United Statesstandard contractual clauses and the EU–US Data Privacy Framework
Brave Software, Inc.Brave Search API — source discovery in the portal research moduleUnited Statesstandard contractual clauses

Standard contractual clauses means the clauses adopted by Commission Implementing Decision (EU) 2021/914. The EU–US Data Privacy Framework means Commission Implementing Decision (EU) 2023/1795 finding an adequate level of protection of personal data for participating entities in the United States.

2. The Operator’s own infrastructure

The services below run on infrastructure administered by the Operator and located in Poland. They are not sub-processors — the Operator does not entrust processing to them but processes the data itself using them. They are disclosed because they mark additional places in which data is stored.

ServiceRoleLocation
LiteLLMproxy mediating calls to language models — the content of requests and responses passes through itPoland
Langfuserecording of language model calls for diagnostics and cost controlPoland
Umamisite traffic analytics, activated only after consent to the analytics categoryPoland
Bugsinkapplication error reporting, with no collection of personal dataPoland

3. Base model providers

Requests to language models are routed exclusively through the OpenRouter gateway listed among the current sub-processors. OpenRouter forwards them to the providers of the base models. The models used in the Service and the providers to which that forwarding leads are:

ModelBase model providerProvider’s registered office
mistral-nemoMistral AI SASFrance
deepseek-v4-flashDeepSeekPeople’s Republic of China
text-embedding-3-small, gpt-4o-miniOpenAI, L.L.C.United States

The Operator has no separate contracts with the providers of the base models; the basis for the transfer remains the data processing agreement concluded with OpenRouter, which is answerable to the Operator for that onward engagement. The table states the providers’ registered offices because the Operator holds no confirmation of the locations in which those providers physically process the data forwarded to them.

4. Notice of changes

The Operator gives the Client at least 30 days’ notice before adding a sub-processor or replacing an existing one — by a message sent to the email address associated with the Account and by updating this list. Within 30 days of the notice the Client may raise a reasoned objection; the effects of an objection, including the right to terminate the agreement free of charge, are set out in the section “Sub-processors” of the Data Processing Agreement.

Every change to the list is recorded in the section “Change history” together with the date and the version number of this document.

5. Change history

VersionDateChange
1.02026-09-15First publication of the list of sub-processors.

The history covers changes made from the date of first publication. Entries remain in the table after a sub-processor is withdrawn, so that it stays possible to establish who processed the data and during what period.

This document exists in Polish and English. In case of any discrepancy, the Polish version prevails.