Legal
Subprocessors
Effective September 23, 2026 · Kratu AI LLC
These providers process personal data on our behalf, under contracts that bind them to protect it. See our Privacy Policy and Data Processing Addendum. Services you connect yourself (your own webhooks, Zapier, Google Sheets) receive data at your direction and aren't our subprocessors.
1. Current subprocessors
| Subprocessor | Purpose | Personal data | Location |
|---|---|---|---|
| IONOS Inc. | Application servers and primary database | All account data, content and respondent responses | United States |
| IONOS Inc. | Encrypted database backups | All stored data (encrypted), retained up to 30 days | United States |
| Cloudflare, Inc. | Web hosting (static app), CDN, DNS, DDoS/WAF protection, bot checks (Turnstile) | IP address, request metadata, device/browser signals | Global edge network; United States |
| Google LLC (Gemini API) | AI features: drafting hypotheses and forms, analysing responses, verdicts, adaptive follow-up questions | Idea and research content; samples of respondent answers (fields detected as contact details are excluded from analysis) | United States |
| Google LLC (Sign-In) | Optional sign-in with Google | Name, email, profile picture, Google account ID | United States |
| Microsoft Corporation / Apple Inc. | Optional sign-in with Microsoft or Apple | Name, email (or Apple private relay address), provider ID | United States |
| Stripe, Inc. | Payments, subscriptions, invoices, tax | Name, email, billing address, payment method (held by Stripe, never by us), transaction history | United States |
| Sendinblue SAS (Brevo) | Account and notification email; marketing email (only if you opt in); contact management | Name, email, plan, signup date, email consent status, email engagement events | European Union (France) |
| PostHog, Inc. | Product analytics (only with your consent, or until you opt out where opt-out applies) | Pseudonymous user ID, pages viewed, clicks, device/browser, approximate location | United States |
| Google LLC (Tag Manager / Analytics) | Site analytics (same consent rules as PostHog); no advertising features | Cookie ID, pages viewed, device/browser, approximate location | United States |
| Functional Software, Inc. (Sentry) | Error monitoring | Technical error reports; may incidentally contain content being processed when an error occurred | United States |
2. Changes and notifications
We give at least 30 days' notice before adding a subprocessor, by updating this page. To get notices by email, write to [email protected] with the subject "Subprocessor notices".