Trust

Subprocessor and transfer register

Current provider purposes and data boundaries for Clanker Cloud. Register version 2026-09-18.

Scope

How to use this register

This public register describes the Standard service. It is not a certification, DPA, BAA, CJIS agreement, residency commitment, or promise that every listed provider processes every customer’s data. A protected order identifies the approved subset, region, transfer mechanism, support access, notice process, and replacement procedure for that customer.

Provider

Cloudflare, Inc.

Purpose: Website delivery, Worker proxy, Workers AI voice and document indexing for supported Standard features; shared Workspace compute, sandboxes, browsers, Durable Objects, queues, indexes, and object storage.
Data categories: Network and request metadata; optional voice audio, transcript, and generated speech; Workspace content, files, extracted text, embeddings, commands, runtime state, and recovery data submitted or generated for the service.
Location and transfer boundary: Global shared service. Standard account region is not a residency guarantee. Contracted jurisdiction controls require separate written activation.

Provider

Supabase, Inc.

Purpose: Website waitlist collection and storage.
Data categories: Waitlist email, optional name and message, signup source, status, and submission metadata.
Location and transfer boundary: The waitlist project location and any international transfer follow the configured Supabase project and provider safeguards. People may request removal; if this provider changes, the register is updated and data is deleted or migrated under the retention policy and applicable contracts.

Provider

Google Cloud

Purpose: Standard account control plane and database, hosted-inference transport, temporary web-to-desktop remote relay, legacy GCP sandbox runtime or state where applicable, and approved Business Gemini inference through Vertex AI when active, and separately contracted dedicated or sovereign environments.
Data categories: Account, authentication, security, service, and audit metadata; saved Workspace conversations, tool results and metadata in Cloud SQL; hosted-inference prompts and responses during model processing; temporary remote instructions, status, and results in Cloud SQL under the disclosed retention schedule; legacy GCP sandbox commands, files, runtime data, and state where applicable. Protected customer data is accepted only after contracted activation.
Location and transfer boundary: The Standard control-plane location is configured operationally, is not a customer-selected placement, and is not a residency commitment; Google may process or support Standard data in other locations under its applicable terms and transfer safeguards. A protected processing region applies only when identified in signed terms and the environment is verified and active.

Provider

Google Gemini Developer API

Purpose: Standard hosted model inference.
Data categories: Prompt and conversation context sent for inference, generated response, and provider technical metadata.
Location and transfer boundary: Standard is not a protected environment for regulated clinical records or other regulated data. Protected processing requires a separately approved model service and written activation.

Provider

Google Cloud Vertex AI

Purpose: Approved Business Gemini inference when provider verification is active.
Data categories: Prompt, supplied context and approved attachments, generated output, and technical service metadata.
Location and transfer boundary: Only the configured project, location, models and stateless requests are approved. ZDR depends on verified abuse-monitoring eligibility, disabled request-content logging and cache controls. This does not cover Clanker Workspace storage, technical or billing records, or an organization-wide residency commitment.

Provider

OpenAI API and Moonshot AI

Purpose: Optional Standard hosted inference for selected supported models.
Data categories: Prompts, conversation context, tool descriptions and results, generated responses, and service metadata.
Location and transfer boundary: Their applicable provider terms and transfer safeguards apply. These model paths are unavailable under the Business Gemini-only processing profile. OpenAI API inference is separate from optional OpenAI Ads measurement.

Provider

Google Identity Services

Purpose: Optional Google social sign-in.
Data categories: OAuth identifier and basic account profile fields authorized by the user.
Location and transfer boundary: Processed under Google’s applicable identity-service terms and transfer safeguards.

Provider

Google Workspace APIs and MCP services

Purpose: Optional user-connected access to selected Google Drive files through Google Picker and Google’s official Drive, Docs, and Sheets remote MCP servers, with bounded Workspace API fallbacks for reviewed tools absent from the preview catalog; separately connected Gmail uses the official Gmail MCP server to search/read mail and create drafts.
Data categories: Google account identifier and email, OAuth scope and token data, identifiers and content of files the user selects, Gmail message and thread content, recipients, labels and drafts used in requested operations, MCP and fallback operation inputs and results, and provider technical metadata.
Location and transfer boundary: Optional and separate from social sign-in. Clanker requests per-file drive.file access for Google files and separate gmail.readonly and gmail.compose access for Gmail, exposes only a reviewed tool allowlist, does not automatically import or index an entire Drive or mailbox, and revokes the token when the connection is removed. The MCP services are Developer Preview; a fallback never retries a failed or uncertain MCP write. Processing operates under Google’s applicable terms, transfer safeguards, and Google API Services User Data Policy.

Provider

GitHub, Inc.

Purpose: Optional GitHub social sign-in.
Data categories: OAuth identifier and basic account profile fields authorized by the user.
Location and transfer boundary: Processed under GitHub’s applicable service terms and transfer safeguards.

Provider

Google Analytics

Purpose: Optional website measurement after affirmative opt-in.
Data categories: Page, interaction, approximate location, browser, and device metadata. No prompts, raw backend errors, credentials, or remote instructions.
Location and transfer boundary: Not loaded before opt-in. Users can withdraw consent from Cookie settings.

Provider

OpenAI Ads measurement

Purpose: Optional ad attribution and subscription-checkout-start measurement after affirmative opt-in.
Data categories: Network, browser, device, attribution, account-page, and selected plan slug, name, and price. Clanker does not manually pass email, account identifiers, signed checkout references, prompts, responses, credentials, or raw backend errors. If automatic advanced matching is enabled, the SDK may detect supported page information and transmit browser-generated SHA-256 hashes rather than raw values.
Location and transfer boundary: The SDK is permitted only on the portal account experience and is not loaded before opt-in. Cookie settings send the SDK a denied consent state to stop future measurement pings.

Provider

YouTube / Google video embeds

Purpose: Optional playback of public product videos after the visitor clicks the load control.
Data categories: Network address, browser and device metadata, and video interaction data received by Google/YouTube after loading.
Location and transfer boundary: Videos use youtube-nocookie.com and are not requested before the visitor clicks. YouTube remains an independent third-party service under its own terms and transfer safeguards.

Provider

Stripe, Inc.

Purpose: Payment processing and transaction administration.
Data categories: Payment, billing contact, transaction, fraud-prevention, and legally required records handled through Stripe.
Location and transfer boundary: Processed under Stripe’s applicable service terms, privacy commitments, and transfer safeguards.

Procurement and change notice

Discuss DPA terms or a protected-environment schedule

Email support@novlabs.ai to discuss proposed DPA terms, detailed provider terms, transfer-mechanism information, or a protected architecture review. This page does not state that a DPA is already available or executed. No DPA applies until signed by authorized parties. Regulated-data, residency, and protected-environment commitments additionally require the identified environment to be verified and active.

Material register changes will be published here with a new version date. Contracted customers receive any additional notice and objection rights stated in their signed DPA or order.

When a provider is removed, affected data is deleted, returned, or migrated under the Privacy Policy and applicable contract. Waitlist participants can request removal at the same contact address.