Subprocessors

This directory identifies providers that may handle personal data for Annot8. Actual use depends on enabled features and deployment configuration. A provider can be a processor for service content and an independent controller for its own account, fraud, tax or legal purposes. The executed DPA's schedule identifies the subprocessors authorized for a customer's processing; this directory does not establish that every listed company is a subprocessor for every purpose.

Public vendor materials describe available services, not proof of Annot8's account region, contract, retention or transfer arrangements. Contact privacy@annot8.app for the receiving entities, locations, enabled workloads and executed safeguards relevant to your service before a restricted-transfer use case begins.

• Clerk, Inc. — Authentication, account identity, organizations, and session security. Data: Account identifiers, names, email addresses, profile details and authentication/session metadata. Locations: United States and provider/subprocessor infrastructure; verify the applicable account configuration and support access. DPA · Subprocessors
• Convex, Inc. — Database, server functions, scheduled jobs, realtime synchronization and file storage. Data: Workspace and visitor records, customer content, media, AI outputs/embeddings, notification records and operational metadata. Locations: Deployment-selected hosting region; Annot8's actual region and backup/support locations must be confirmed for the contracted service. DPA · Subprocessors · Available regions
• Vercel Inc. — Web hosting, delivery, server execution, AI Gateway, Workflow, Sandbox and operational logs. Data: Request/network metadata and content processed by enabled app, AI and repository-agent workloads. Locations: Global delivery infrastructure and configured execution locations; hosting location alone does not establish AI, sandbox, log or support residency. DPA · Trust center and subprocessors
• OpenAI (upstream AI provider through Vercel AI Gateway) — AI classification, generation, screenshot analysis, transcription, embeddings and proposed code fixes. Data: Relevant prompts, selected content/media, chat context, repository context, tool results and model outputs. Locations: Provider infrastructure and the contracted Gateway route; no particular region or zero-retention arrangement is implied by this list. Provider DPA · Provider subprocessors · Gateway privacy controls
• Resend (Plus Five Five, Inc.) — Transactional, service and customer-configured visitor email delivery. Data: Recipient and sender addresses, email content, delivery records and unsubscribe metadata. Locations: United States storage and provider delivery infrastructure. DPA · Subprocessors · Data handling
• Sentry (Functional Software, Inc.), when configured — Application error monitoring. Data: Minimized error classification and stack locations; application filters exclude request bodies, user profiles, breadcrumbs and tracing. Network metadata remains visible to the provider. Locations: Project-selected hosting and provider infrastructure; verify the actual project region. DPA · Subprocessors

Lark, through the contracting entity identified in the applicable account agreement, provides Annot8's support and legal email inboxes. It processes correspondence, contact details, attachments and email delivery/security metadata. This supports Annot8's account, support, rights-request and legal purposes; customer content supplied for support may also require the applicable processor arrangements. Actual storage, support locations and retention must be confirmed for the account rather than inferred from the provider's headquarters. Avoid sending passwords or sensitive customer content in an initial email.

Lark customer terms · DPA · Subprocessors

These providers serve Annot8's own consent-based measurement. They do not receive customer widget analytics events through Annot8's built-in customer Analytics system, which runs on the core hosting/database infrastructure. Both require Analytics consent and remain disabled when not configured.

• Google Analytics (contracting Google entity depends on the applicable account terms) — Consent-gated Annot8 website acquisition, page-view, funnel and web-vitals measurement, when configured. Data: Pseudonymous browser identifiers, minimized measurement events and connection metadata; advertising signals are disabled. Locations: Google infrastructure; confirm account retention, contractual entity and transfer terms. Data-processing terms · Subprocessors
• PostHog, Inc., when configured — Consent-gated Annot8 product analytics; autocapture and session replay are disabled. Data: Pseudonymous browser identifiers, allowlisted product events and connection metadata. Locations: Selected US or EU project region, subject to provider support and subprocessor arrangements. Privacy and data handling · Account legal documents

Polar Software, Inc. and its affiliates provide checkout, merchant-of-record services, subscriptions, orders, tax and payment handling. Polar may act as an independent controller for buyer, payment, fraud and tax processing and as a processor for particular activities under its DPA; it is not uniformly an Annot8 subprocessor. Payment-card details are handled by the merchant of record rather than stored by Annot8.

Polar DPA · Privacy Policy · Buyer Terms · Subprocessors

If a person subscribes to web-push notifications, the browser/device push service processes an endpoint and delivery metadata. The receiving provider and location depend on the browser/device. Notification delivery uses encrypted payloads; the workspace must still minimize notification content and protect subscription endpoints.

Slack, Linear, Jira/Atlassian, Asana, Discord, Microsoft Teams, Trello, GitHub, GitLab, email recipients and custom webhooks receive content under the customer's configuration and instructions. Their role depends on the actual arrangement; they may be the customer's processor or an independent controller. Destination contracts, permissions, notices and deletion handling must be documented. This does not remove Annot8's obligations for a provider it engages as its own subprocessor.

Before a restricted transfer, the responsible parties must establish the applicable safeguards. The executed schedule must identify actual recipients, hosting/support countries and roles, and the applicable adequacy coverage, EU SCCs, UK Addendum or IDTA, Swiss adaptations, Brazilian ANPD clauses, Turkish standard contracts and required filings, or other local mechanism. Linking public terms does not execute a contract, establish residency, or validate a particular transfer. OpenAI's direct-customer DPA is reference material; verify the actual upstream arrangement for Vercel Gateway processing.

Register a legal or privacy contact through the order form or by emailing privacy@annot8.app to receive contractual subprocessor-change notices. Notice and objection periods are governed by the executed DPA, including any agreed advance-notice requirement. Keep that contact current. An objection should describe the reasonable data-protection concern so the parties can evaluate an alternative or termination of the affected service under that agreement.