Version 2026-10-08 · effective [[TO FILL: effective date]]
Subprocessors
The companies that process personal data to run Tidal AI for us, what each one does, and where.
These are the service providers ("subprocessors") that may process personal data when you use Tidal AI. Each is bound by a data processing agreement with us. We tell customers about new subprocessors [[TO FILL: notice period, e.g. 30 days]] before they start processing their data; to be notified, [[TO FILL: how to subscribe to subprocessor updates]].
Infrastructure
| Provider | What it does for us | Data | Location | Transfer safeguard |
|---|---|---|---|---|
| Fly.io, Inc. | Runs the Tidal AI app and API, and the isolated machines that run your bots' code and the apps they deploy | All service data in transit and in memory; code and files in bot machines | [[TO FILL: Fly regions used, e.g. London (lhr)]]; company in the United States | [[TO FILL: DPF / SCCs + UK Addendum]] |
| Neon, Inc. (on Amazon Web Services) | Our database | Account, workspace content, usage, logs | AWS eu-west-2 (London, UK); company in the United States | [[TO FILL: DPF / SCCs + UK Addendum]] |
| [[TO FILL: Tigris Data, Inc., or the production object store]] | Stores files: drive files, build outputs, screenshots, artifacts | Files you and your bots create or upload | [[TO FILL: region]] | [[TO FILL: safeguard]] |
AI models
| Provider | What it does for us | Data | Location | Transfer safeguard |
|---|---|---|---|---|
| OpenRouter, Inc. | Routes each request to the AI model you or your bot chose | The conversation and the context a bot needs for that step; a pseudonymous identifier (a keyed hash of the workspace id, never a name or email) for abuse tracing; the name and web address of the app ("Tidal AI") as app attribution | United States | [[TO FILL: DPF / SCCs + UK Addendum]] |
| Model providers, reached through OpenRouter: Anthropic, OpenAI, Google, Meta (Llama, via hosting providers), Mistral, xAI, DeepSeek, Qwen (Alibaba), Moonshot, Z.ai, MiniMax, Cohere, Amazon, Microsoft, NVIDIA, Perplexity, ByteDance Seed, and the inference hosts that serve their models | Generate the bot's answer | The same request, processed only to answer it. We request providers that do not retain prompts or train on them | United States and other countries depending on the model and host [[TO FILL: list countries, or restrict routing]] | [[TO FILL: per provider]] |
If you add your own model provider key, requests on that key go directly to that provider under your own agreement with them; it is not our subprocessor for that traffic.
Communications
| Provider | What it does for us | Data | Location | Transfer safeguard |
|---|---|---|---|---|
| Resend (Resend, Inc.) | Sends sign-in emails, account notices and the email your bots send; receives email for bot mailboxes | Email addresses, message content and attachments | United States | [[TO FILL: DPF / SCCs + UK Addendum]] |
| Browser push services: Google (Firebase Cloud Messaging), Mozilla, Apple, Microsoft | Deliver push notifications to devices where you turned them on | A device token and a short notice (headline and link only) | Varies by browser maker | [[TO FILL: safeguard]] |
Sign-in (only if you choose them)
| Provider | What it does | Data | Location |
|---|---|---|---|
| Google LLC | "Continue with Google" sign-in | Your Google account's email, name and picture | United States |
| GitHub, Inc. | "Continue with GitHub" sign-in | Your GitHub account's email, name and avatar | United States |
Optional and future providers
| Provider | When | Notes |
|---|---|---|
| [[TO FILL: payment provider, e.g. Stripe]] | When paid credits launch | Payment details are collected by the payment provider; we receive only what we need to record the purchase |
| [[TO FILL: hosted browser provider, if BROWSER_WS_ENDPOINT is used in production]] | If bots' web browsing runs on a hosted browser service | Pages a bot visits and screenshots of them |
| Expo (650 Industries, Inc.) | Only if you connect your own Expo account to build mobile apps | Your project's code, sent with your own token |
Not subprocessors
Services you connect to your workspace (your email account, databases, APIs, MCP servers, file servers, and the out-of-the-box news, Wikipedia, Hacker News, weather and DeepWiki connectors) receive what your bots send them because you or your bots chose to use them. They act under their own terms, not on our behalf.