How Google processes data
Necessary

Remember the site's theme and your choice in this window, in this browser's storage. Cloudflare's protective cookies protect the site from bots. Always on.

Google Analytics (Google Ireland Limited) counts visits and shows which sites and campaigns they come from. Cookies: _ga, _ga_*.

Google Ads (Google Ireland Limited) measures whether a visit from an ad ends with a click on the sign-up button. Cookies: _gcl_au and related.

List of cookiesHow Google processes data
Try 30 days free
How it worksTutorialsPricingFAQ
Sign in

List of Processors and Recipients, Annex 3 to the Terms of Service

Download (.md)
Contents

Version 1.2. Date of the last change: 2026-11-01.

1. Processors that process data on our instruction

entityservicedatacountry of processingbasis for the transfer outside the EEAcommitments and differences from the Data Processing Agreement
Cloudflare, Inc., 101 Townsend St, San Francisco, USA (contract and DPA: cloudflare.com/cloudflare-customer-dpa; list of sub-processors: cloudflare.com/gdpr/subprocessors)passing traffic on to our server and bot protection (Turnstile)IP address, technical data sent with requests, browser characteristics; the content of requests in transitglobal network, EU and USAEU-U.S. Data Privacy Framework; should the certification lapse, standard contractual clauses (module 2) from Cloudflare's DPABreaches “without undue delay”; changes of sub-processors announced on its list
Anthropic Ireland, Limited, Dublin (the contracting party for customers from the EEA); terms: anthropic.com/legal/commercial-terms, DPA: anthropic.com/legal/data-processing-addendum, list of sub-processors: anthropic.com/subprocessorslanguage model for generating drafts of plans, documents and acceptance liststhe text selected for generation (source material, prompt, the plan's documents) and the fields of the project template, including the Organization's name and the project's name; without email addresses and account identifiersIreland (contract); USA and the countries of Anthropic's sub-processors (processing by Anthropic, PBC)no transfer outside the EEA from us: the contract is with Anthropic Ireland, Limited; the onward transfer to Anthropic, PBC (USA, not on the DPF list) is carried out and safeguarded by Anthropic Ireland with standard contractual clauses (DPA sections C and I), and Anthropic Ireland is liable to us for itdoes not train models on customer data (commercial terms, section B); deletes inputs and outputs within 30 days, except content flagged as a violation of the usage policies (up to 2 years; classification results up to 7 years) and data required by law; new sub-processors: notice and 15 days to object (DPA C.3), shorter than our 30 days; after the end of featureloom's contract with Anthropic it deletes the data within 30 days with the exceptions in DPA H.1
Stripe Payments Europe, Limited, Dublin (for the EEA) and Stripe, LLC, USA; Stripe's data processing agreement: stripe.com/legal/dpahandling of the checkout, subscriptions and payment events for the data that we sendthe identifier of the Organization and of the purchase, what the customer buys or changes, the currency, the amount refunded, the language of the checkout, the Stripe customer identifierIreland, USAEU-U.S. Data Privacy Framework and standard contractual clauses in Stripe's DPAStripe's DPA point 2 and following

2. Recipients that are not our processors

entitywhendatarole
Sold through Link, LLC (“Link”) and Stripe, LLC, USA; stripe.com/privacy, link.com/termsthe purchase of a subscription or a balance top-upcard details, billing and tax address, the email and name given at the checkout; payment historyseparate controller; it makes the purchase data available to us in the dashboard (point 3 of the Privacy Policy)
Google Ireland Limited, Ireland; policies.google.com/privacysigning in with Google, when you choose itGoogle identifier, email address, confirmation of the address, Workspace domainseparate controller (identity provider)
Cloudflare, Inc., USA; cloudflare.com/turnstile-privacy-policythe Turnstile challenge and a security challenge for part of the trafficthe data from these challenges (IP address, TLS fingerprint, browser)separate controller for the purpose of improving bot detection
Slack Technologies Limited, Ireland (for workspaces outside the USA and Canada) or Slack Technologies, LLC, USA; slack.com/trust/privacyonly when the Organization turns on the integrationnames of plans and projects, excerpts of questions of up to 300 characters, the person's display namethe Organization's processor, on its Slack account
the provider of the model of a person's agent and every MCP client that a person or an Organization connects through a console or an automation keyonly when a person or an Organization connects an agentdocuments of plans, prompts and epics, projects, notes, questions and answers, names of people and of the Organization, which the agent retrieves through MCP or the APIa recipient chosen by the person or the Organization, under their own contract with the agent's provider