SUB-PROCESSORS

Radhwane Derraz, operating as Auprimus uses a small number of third-party companies to run Auprimus. This page names every one of them, what each receives, and why. It is the companion to our Privacy Notice: that document says what we do with your information, this one says who else touches it.

We keep this list short deliberately. Every company on it is somewhere your data can be, and each one is a decision we had to justify.

INFRASTRUCTURE

Railway

What it does: Hosts the application and every database behind it.

What it receives: Everything you store — your account records, your workflows, your chat history, the connector credentials you save, and the files each run produces. Railway operates the servers this data sits on.

Where: United States and the European Union, depending on the region a service is deployed in.

Privacy notice: https://railway.com/legal/privacy

Cloudflare

What it does: Sits in front of the website, providing DNS, TLS termination, bot protection and email routing for our @auprimus.com addresses.

What it receives: The IP address and request metadata of traffic to us, and the contents of email sent to our published addresses.

Where: Globally distributed.

Privacy notice: https://www.cloudflare.com/privacypolicy/

ACCOUNTS AND BILLING

Clerk

What it does: Handles sign-in, organizations, and subscriptions.

What it receives: Your name, email address, password (which we never see), profile picture if you sign in with Google, GitHub or Microsoft, and your subscription details. Payment card details are entered into Clerk's own billing component and are never sent to us.

Where: United States.

Privacy notice: https://clerk.com/legal/privacy

Stripe

What it does: Processes card payments on Clerk's behalf. We have no direct relationship with Stripe; it is named here because your card details reach it.

What it receives: Your payment card details and billing address.

Where: United States.

Privacy notice: https://stripe.com/privacy

SEARCH

Voyage AI

What it does: Turns text into numeric vectors so the system can find the right skill or connector for an instruction.

What it receives: The text of our own skill and connector descriptions, and the text of a node's instruction when matching one to it. It does not receive the data your workflows read or produce.

Where: United States.

Privacy notice: https://www.voyageai.com/privacy-policy

AI PROVIDERS

Which of these processes your data is your choice: you select the model, and you supply the API key for it. Whatever a workflow sends to a model — your instruction, the data it reads, the output it produces — goes to that provider under that provider's terms, including whatever they say about retention and training. We do not choose for you, and we cannot see inside their systems.

Google (Gemini) — https://ai.google.dev/gemini-api/terms

OpenAI — https://openai.com/policies/privacy-policy

Anthropic — https://www.anthropic.com/legal/privacy

xAI — https://x.ai/legal/privacy-policy

Meta — https://ai.developer.meta.com/legal

DeepSeek — https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html

Models you run yourself through Ollama send nothing to anyone: the model runs on hardware you control.

The single exception to bring-your-own-keys is the one free model we provide on our own account, so that an account works before you have added a key. That model's provider receives what you send it, on the same terms as above.

CONSENT MANAGEMENT

Termly

What it does: Provides the cookie consent banner and preference centre.

What it receives: Your cookie preferences and the identifier used to remember them.

Where: United States.

Privacy notice: https://termly.io/our-privacy-policy/

WHAT WE DO NOT USE

We think this is worth stating, because most services this size use all of them: we run no analytics platform, no advertising or marketing technology, no session recording, no customer data platform, and no third-party support widget. Nothing on this page is here to observe you.

CHANGES TO THIS LIST

We will update this page before adding a sub-processor that receives your data, not after. If you have a written agreement with us that requires notice of changes, that agreement governs.

Questions about anything on this page: [email protected]