Subprocessors

Core infrastructure

Vendor	Purpose	Data categories
Google Cloud Platform	Hosting, storage, networking, monitoring	Account data, application data, logs/metadata, IP address

DPA/terms: see Google Cloud data processing terms in your Google Cloud account documentation.

Analytics & measurement (only with consent in EU/UK)

Vendor	Purpose	Data categories
Google Tag Manager	Loads analytics/measurement tags	Device/browser data, event metadata, IP address
Google Analytics (GA4)	Product analytics and performance measurement	Usage events, device/browser data, IP address

We load analytics tags only after you opt in via our cookie banner/settings.

Payments

Vendor	Purpose	Data categories
Stripe	Payment processing, invoicing, fraud prevention	Billing details, payment metadata, contact details

We do not store full card details; Stripe processes payments.

AI processing

Vendor	Purpose	Data categories
Google Gemini / Vertex AI	AI-assisted features (text generation, analysis)	Inputs you submit to AI features (may include personal data if you provide it)

We aim to minimize personal data sent to AI systems and use contractual/technical controls to protect data.

Subprocessor selection and security

We assess subprocessors for security, reliability, and data protection practices. We prioritize vendors with mature compliance programs, strong audit histories, and contractual commitments aligned with our privacy obligations.

Where applicable, we use role-based access control, encryption in transit and at rest, and least‑privilege principles to limit exposure of personal data.

Changes to subprocessors

We may update this list as our infrastructure evolves. Material changes will be posted here, and we will provide reasonable notice when required by law or contract.

Need external privacy support?

If you need help with privacy operations, GDPR representation, or compliance services, you can compare vetted providers via the Cruxi directories hub.

Contact

Questions? Email privacy@cruxi.ai.