Sub-processors
To operate CloudCoord we rely on a small number of trusted service providers (“sub-processors”) that process personal data on our behalf. CloudCoord is operated by Cloud Coordinator, LLC. Each provider below receives only the data needed to perform its function, under contractual data-protection terms. We do not sell personal data, and we do not share it for advertising.
| Sub-processor | Purpose | Data processed | Location | Terms |
|---|---|---|---|---|
| Supabase, Inc. | Managed Postgres database, authentication, and encrypted file storage | All account and transaction data, uploaded documents, encrypted OAuth tokens | United States | DPA in place |
| OpenAI OpCo, LLC (OpenAI API) | Primary AI provider: document classification, data extraction, compliance review, and draft generation | Document and email content submitted for processing | U.S. company; does not commit to a processing location for our account, so processing may occur outside the United States | OpenAI API business terms; no model training on API data; abuse-monitoring logs kept up to 30 days; responses not stored (store off); parts of a request may sit in an encrypted prompt cache for up to 24 hours |
| Anthropic, PBC (Claude API) | Backup AI provider: the same tasks, used when OpenAI is unavailable or when we move work back to Anthropic | Document and email content submitted for processing | U.S. company; stores data in the United States; does not commit to a processing location for our account, so processing may occur outside the United States | DPA in place; no model training on inputs; ~30-day deletion |
| Vercel Inc. | Application hosting, serverless compute, and page-view analytics | Request/response data in transit (not persistently stored by Vercel), plus aggregate page-view analytics that Vercel does retain: page shape, referrer, country and device type. The analytics are cookieless and do not use browser storage for tracking. Page addresses are stripped of the query string and of transaction, document and access-token identifiers in the browser before collection, so no transaction or client is identifiable from them. | United States | DPA in place |
| Stripe, Inc. | Subscription payment processing | Customer email and payment data (card data handled directly by Stripe) | United States | DPA in place; never receives Gmail-derived data |
| Resend (Plus Five Five, Inc.) | Delivery of transactional email — account and security notifications, and your briefing emails | Recipient email address and notification content, including the transaction details summarized in a briefing (property address, deadlines, and the text of open questions) | United States | DPA in place |
Your connected Gmail account
If you connect Gmail, CloudCoord accesses your mailbox through Google’s API on your behalf to read transaction-related email and send drafts you approve. Google is your own mail provider rather than a CloudCoord sub-processor, and our use of Google user data adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can disconnect Gmail at any time from Settings.
International transfers
Every sub-processor listed above is a U.S. company. Supabase, Vercel, Stripe, and Resend process data in the United States. Our AI providers, OpenAI and Anthropic, do not commit to a processing location for our account, so content they process may be handled outside the United States. CloudCoord is offered only to real estate professionals located in the United States, so we do not make transfers of EU, UK, or Swiss personal data. Each sub-processor is engaged under contractual data-protection terms; see the Terms column above.
Changes and notifications
We update this page when we add or replace a sub-processor. To be notified of changes in advance, or to ask about a provider’s data-protection terms, email privacy@cloudcoordinator.io.