Sub-processors
To deliver the Service, Code Crafters ("Sheet Intelligence", "we") engages the third-party sub-processors below. Each is bound by a written contract imposing data-protection obligations at least as protective as ours, and we remain fully liable to you for their performance. We give business customers advance notice of any intended addition or replacement of a sub-processor and an opportunity to object; to be notified, contact info@sheetintelligence.app.
Active services and proposed routes are distinguished below. Listing a pending AI provider is not approval to send it content. Anthropic remains the enabled default AI route. New providers require account-specific review, advance notice where required and current in-app permission before activation.
| Sub-processor | Purpose | Data processed | Location | Transfer safeguard |
|---|---|---|---|---|
| Vercel Inc. | Website, customer dashboard and browser Excel task-pane hosting; private waitlist | Account/website request metadata, email/signup metadata; browser delivery infrastructure | United States (waitlist storage); global edge network (website delivery) | Vercel Data Processing Addendum |
| Anthropic, PBC (Claude API) | Generate the AI assistant's responses | Content from the open workbook — cell values, formulas and notes from any of its tabs, plus rendered images of a range for visual checks — and chat messages, under zero data retention / no model training | United States | EU-US DPF (if certified) and/or 2021 SCCs / UK Addendum, per Anthropic's DPA |
| Amazon Web Services (AWS) | Backend hosting, compute, database, storage, Bedrock semantic-search embeddings and SES email delivery | All Service data (session state, account, audit) | us-east-1 | AWS DPA + SCCs; published AWS sub-processor list |
| Lemon Squeezy | Billing + subscription management (merchant of record) | Name, email, subscription/payment metadata (not spreadsheet content) | United States | Lemon Squeezy DPA + SCCs |
| Cloudflare | Restricted Founder-panel access, tunnel and security infrastructure | Operator identity and request/security metadata; no model inference | Global network; account-specific processing locations require confirmation | Applicable Cloudflare data-processing terms; account and transfer coverage under review |
| Zoho Mail | Business mailbox for customer support, legal/privacy correspondence and vendor enquiries | Email addresses, message content and attachments you send to our business mailbox | Account data centre and support locations require confirmation | Zoho Privacy Policy and applicable DPA/transfer terms; account coverage under review |
Published vendor data-processing documents are references, not proof that a particular account has executed every available addendum or residency arrangement. We verify applicable contractual and transfer coverage before introducing a new data recipient. Google and Microsoft also provide their respective identity and spreadsheet platforms under the terms applicable to your account.
Additional supported AI routes — pending activation
- OpenAI API: eligible for Google Sheets and Microsoft Excel after review. Inputs/outputs are not used for training by default under business API controls. Abuse-monitoring retention can apply, commonly up to 30 days, with endpoint/model and account-specific exceptions. Processing location depends on the approved account and region; no zero-retention or residency arrangement is asserted here. Official data controls.
- Google Gemini paid API: eligible for both integrations after review of the actual billed project and terms. Paid-service prompts/responses are not used for product improvement; limited safety logging and international processing can apply. Unpaid-service data-use terms are not permitted for Google Sheets routes. Official paid-service terms.
- Kimi / Moonshot: Microsoft Excel only, pending written confirmation of account-specific conditions. Published privacy materials identify Singapore hosting; exact inference, support and onward-processing locations require confirmation. The API security FAQ states no training, while the API agreement reserves broader content-use rights absent a separate written restriction. We are seeking clarification before activation. API agreement and security FAQ.
- DeepSeek API: Microsoft Excel only, pending API-specific contract, training/retention and transfer review. General privacy materials describe China storage but do not conclusively establish downstream API terms. Exact recipients and locations must be confirmed before activation. API agreement.
All AI routes can receive the workbook context and messages needed for a requested feature; image content is sent only to a model approved for that capability. We do not provide Google Workspace content or derived data to Kimi/DeepSeek, or for generalized model training. An approved Microsoft route with training-permitted terms can receive content for that additional purpose only with separate optional permission, applicable Controller authorization and reviewed contractual/transfer safeguards. No such route is currently enabled.
Regional arrangements and transfer documents are verified before each pending recipient is activated. Inclusion here does not mean a particular certification, SCC, UK Addendum or zero-retention agreement has already been executed for that recipient.
This list is maintained as required by GDPR/UK GDPR Art. 28. It is referenced by our Privacy Policy and our Data Processing Agreement, which sets out how we notify customers before a new sub-processor begins processing.