Sub-processors
To operate CloudCoord we rely on a small number of trusted service providers (“sub-processors”) that process personal data on our behalf. CloudCoord is operated by Cloud Coordinator, LLC. Each provider below receives only the data needed to perform its function, under a Data Processing Addendum (DPA) with appropriate data-protection terms. We do not sell personal data, and we do not share it for advertising.
| Sub-processor | Purpose | Data processed | Location | Terms |
|---|---|---|---|---|
| Supabase, Inc. | Managed Postgres database, authentication, and encrypted file storage | All account and transaction data, uploaded documents, encrypted OAuth tokens | United States | DPA in place |
| Anthropic, PBC (Claude API) | AI document classification, data extraction, compliance review, and draft generation | Document and email content submitted for processing | United States | DPA in place; no model training on inputs; ~30-day deletion |
| Vercel Inc. | Application hosting and serverless compute | Request/response data in transit (not persistently stored by Vercel) | United States | DPA in place |
| Stripe, Inc. | Subscription payment processing | Customer email and payment data (card data handled directly by Stripe) | United States | DPA in place; never receives Gmail-derived data |
| Resend (Plus Five Five, Inc.) | Delivery of transactional email — system notifications and security alerts only | Recipient email address and notification content | United States | DPA in place |
Your connected Gmail account
If you connect Gmail, CloudCoord accesses your mailbox through Google’s API on your behalf to read transaction-related email and send drafts you approve. Google is your own mail provider rather than a CloudCoord sub-processor, and our use of Google user data adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can disconnect Gmail at any time from Settings.
International transfers
All sub-processors listed above process data in the United States. Where personal data of individuals in the EU, UK, or Switzerland is transferred, we rely on appropriate safeguards — including the EU Standard Contractual Clauses (and the UK International Data Transfer Addendum) incorporated into our agreements with each sub-processor.
Changes and notifications
We update this page when we add or replace a sub-processor. To be notified of changes in advance, or to request a copy of a specific DPA, email privacy@cloudcoordinator.io.