Subprocessors

These companies process personal data so that Kaavit can run. Each does so only on our instructions, under a contract that requires it to protect the data. We update this page at least 30 days before adding or replacing one, as the data processing agreement says. Questions go to privacy@kaavit.com.

AI requests go to one model provider at a time; both are listed because either may be used.

Subprocessor	What for	What it receives	Where
Railway	Hosting the servers, the database and stored images	Everything stored in the service: accounts, boards, comments, images and logs	EU (the Netherlands)
Cloudflare	Serving the app and this site, DNS, and protecting the service from abuse	Every request to the service, including IP addresses	Global network; Cloudflare, Inc. is in the United States
Anthropic	Answering AI requests	The prompt, the part of the board the request covers, and any file attached to it	United States
OpenAI	Answering AI requests	The prompt, the part of the board the request covers, and any file attached to it	United States
Resend	Sending email: verification, password resets, invitations, and mentions and replies in comments	Email addresses, names and the message — for a mention or reply, excerpts of the comments it is about	EU (Ireland); Resend, Inc. is in the United States
Stripe	Paid plans: checkout, subscriptions, invoices and the customer portal. Link, Stripe's payment service, sells the plan and takes the payment	An organisation's name and id, the billing contact's email address and user id, the number of members, and what the buyer enters at checkout. We never receive card details	EU (Ireland); Stripe, Inc. is in the United States
PostHog	Error reports and product usage events, and — with your consent — website analytics on kaavit.com	A user id, the browser and page address, and what failed or happened; never names, emails, prompts or board contents. Website analytics carry no user id and no account	EU (Frankfurt, Germany)