Subprocessors
Leiko Subprocessor List
Keidas AI Oy uses the following subprocessors to provide the Leiko service. This list forms part of the Data Processing Agreement. We notify account holders of additions or replacements at least 30 days in advance by email or in-Service notice.
| Subprocessor | Purpose | Data processed | Processing location | Transfer safeguard |
|---|---|---|---|---|
| Supabase, Inc. | Database, authentication, file storage | All service data: account data, business content (emails, customers, invoices, receipts, chats, memories), encrypted OAuth tokens, files | EU (Stockholm, eu-north-1) | Data hosted in EU; SCCs for any provider support access from outside the EU/EEA |
| Google Cloud (Google Ireland Ltd / Google LLC) | Application hosting (Cloud Run), OCR (Cloud Vision), messaging infrastructure (Pub/Sub), web search (Custom Search) | Application traffic; receipt and document images for OCR; Gmail change notifications (message IDs only, no content); assistant search queries | Hosting: EU (Belgium, europe-west1). Vision/Pub/Sub/Search: EU/US | EU–U.S. Data Privacy Framework; SCCs |
| Google (Gemini API) | AI processing: email classification and summarization, attachment analysis, drafting, memory and style extraction | Email content and metadata, attachments, receipt context, related business context | EU/US | EU–U.S. Data Privacy Framework; SCCs. Paid tier; no training on customer data |
| Anthropic, PBC | AI processing: assistant conversations, substantive drafting, receipt text parsing, profile summaries | Chat messages, email excerpts, receipt text, related business context (customers, invoices, calendar, tasks, memories) | US | EU–U.S. Data Privacy Framework; SCCs. API data not used for model training |
| OpenAI, LLC | AI processing: possible chat fallback and thread titles when the integration is configured | Chat messages and related business context needed for the request; thread titles | US | EU–U.S. Data Privacy Framework; SCCs. API data not used for model training |
| Stripe Payments Europe, Ltd. / Stripe, Inc. | Subscription billing and payment processing | Account email, internal account ID, subscription details; card data is collected directly by Stripe | EU/US | EU–U.S. Data Privacy Framework; SCCs |
| Expo (650 Industries, Inc.) | Push notification delivery, mobile app updates | Push tokens, device platform/name, timezone; notification content (may include email subjects, sender names, summaries, amounts) | US | SCCs |
| Apple Inc. / Google LLC (APNs / FCM) | Downstream push notification transport to devices | Push tokens and notification content, as above | EU/US | EU–U.S. Data Privacy Framework; SCCs |
Notes
- Gmail and Google Calendar are integrations you authorize with your own Google account, governed by Google's terms and your Google permissions; they are listed here only to the extent Google infrastructure processes data on our behalf (rows above).
- Apple Inc. also processes iOS In-App Purchase payments as an independent controller under Apple's terms. We receive product identifier, status, and expiry — not full payment-card details — so Apple is listed here for IAP only to that limited extent, in addition to APNs above.
- We do not use advertising or third-party analytics providers.
Questions: privacy@leiko.ai