Subprocessors
The companies that process personal data for Haarness Cloud, what each receives, and where.
Subprocessors
These are the third parties that process personal data on our behalf to provide Haarness Cloud. Each is bound by a written agreement that restricts its use of the data to providing its service to us and requires appropriate security. The Privacy policy explains what we collect and the Data processing agreement how this list is managed.
Infrastructure
| Company | Purpose | Personal data | Location |
|---|---|---|---|
| Hetzner Online GmbH | Servers for the website, the control plane and the database | All Service data except workspace contents | Ashburn, Virginia, United States |
| Fly.io, Inc. | Cloud workspace and agent machines and their encrypted volumes | Workspace contents and what runs in them | US East (Ashburn, Virginia, United States) |
| Cloudflare, Inc. | Network proxy and protection for every request to the website and API | Everything sent to and from the Service in transit, including IP addresses | Global, the location nearest each visitor |
| Cloudflare, Inc. (R2) | Object storage for workspace exports and backups, database backups, uploaded profile archives and marketplace packages | Workspace contents in exports and backups; database backups; uploaded files | Global, selected automatically by Cloudflare |
Account, payments and email
| Company | Purpose | Personal data | Location |
|---|---|---|---|
| Stripe | Subscriptions, checkout, top-ups, invoices, refunds and disputes | Name, email, billing details, payment method, transaction history | United States and other Stripe locations |
| Twilio Inc. (SendGrid) | Transactional email: verification, password reset, security, billing and service notices | Email address, name, email content | United States |
| Google LLC | Optional sign-in with Google | Google account identifier, email, name, profile picture | United States |
| Apple Inc. | Optional Sign in with Apple | Apple account identifier, email or private relay address, the name you share, the sign-in token we revoke when you delete your account | United States |
Notifications
| Company | Purpose | Personal data | Location |
|---|---|---|---|
| Apple Inc. (Apple Push Notification service) | Delivers the notifications and Live Activity updates of Haarness for iPhone, once you turn them on in the app | The phone's notification token; what the notification shows: the chat title (which can be the start of the chat's first message), the project, computer or Cloud session name, a fixed phrase for the kind of request, the number of waiting requests, and identifiers the app needs to open the chat; for billing and security notices, the kind of notice and, for a team's billing, the team's name | United States and other Apple locations |
| Google LLC (Firebase Cloud Messaging) | Delivers the notifications and live updates of Haarness for Android, only once an Android phone with Haarness registers for notifications in the app | The phone's notification token; the same notification content as Apple receives, sent as a data message: the chat title (which can be the start of the chat's first message), the project, computer or Cloud session name, a fixed phrase for the kind of request, the number of waiting requests, and identifiers the app needs to open the chat; for billing and security notices, the kind of notice and, for a team's billing, the team's name | United States and other Google locations |
Model providers (managed router)
A request reaches a model provider only when you use one of its models through the managed router or a cloud agent. The request content — prompts, files and tool results sent to the model — is processed by that provider to produce the response.
| Company | Models | Location |
|---|---|---|
| OpenAI, L.L.C. | OpenAI models | United States |
| Anthropic, PBC | Claude models | United States |
| Google LLC (Gemini API) | Gemini models | United States |
The models actually offered are listed on Models. We use providers' API or enterprise terms under which API inputs and outputs are not used to train their models.
Changes to this list
We update this page at least 30 days before a new subprocessor starts processing personal data, except in an emergency needed to keep the Service running, in which case we update it as soon as possible. Business customers who have agreed to our DPA can ask to be notified by email at [email protected] and may object to a new subprocessor as described there.