# List of Processors and Recipients, Annex 3 to the Terms of Service

 

Version 1.2. Date of the last change: 2026-11-01.

## 1. Processors that process data on our instruction

| entity | service | data | country of processing | basis for the transfer outside the EEA | commitments and differences from the Data Processing Agreement |
|---|---|---|---|---|---|
| Cloudflare, Inc., 101 Townsend St, San Francisco, USA (contract and DPA: cloudflare.com/cloudflare-customer-dpa; list of sub-processors: cloudflare.com/gdpr/subprocessors) | passing traffic on to our server and bot protection (Turnstile) | IP address, technical data sent with requests, browser characteristics; the content of requests in transit | global network, EU and USA | EU-U.S. Data Privacy Framework; should the certification lapse, standard contractual clauses (module 2) from Cloudflare's DPA | Breaches “without undue delay”; changes of sub-processors announced on its list  |
| Anthropic Ireland, Limited, Dublin (the contracting party for customers from the EEA); terms: anthropic.com/legal/commercial-terms, DPA: anthropic.com/legal/data-processing-addendum, list of sub-processors: anthropic.com/subprocessors | language model for generating drafts of plans, documents and acceptance lists | the text selected for generation (source material, prompt, the plan's documents) and the fields of the project template, including the Organization's name and the project's name; without email addresses and account identifiers | Ireland (contract); USA and the countries of Anthropic's sub-processors (processing by Anthropic, PBC) | no transfer outside the EEA from us: the contract is with Anthropic Ireland, Limited; the onward transfer to Anthropic, PBC (USA, not on the DPF list) is carried out and safeguarded by Anthropic Ireland with standard contractual clauses (DPA sections C and I), and Anthropic Ireland is liable to us for it | does not train models on customer data (commercial terms, section B); deletes inputs and outputs within 30 days, except content flagged as a violation of the usage policies (up to 2 years; classification results up to 7 years) and data required by law; new sub-processors: notice and 15 days to object (DPA C.3), shorter than our 30 days; after the end of featureloom's contract with Anthropic it deletes the data within 30 days with the exceptions in DPA H.1  |
| Stripe Payments Europe, Limited, Dublin (for the EEA) and Stripe, LLC, USA; Stripe's data processing agreement: stripe.com/legal/dpa | handling of the checkout, subscriptions and payment events for the data that we send | the identifier of the Organization and of the purchase, what the customer buys or changes, the currency, the amount refunded, the language of the checkout, the Stripe customer identifier | Ireland, USA | EU-U.S. Data Privacy Framework and standard contractual clauses in Stripe's DPA | Stripe's DPA point 2 and following  |

## 2. Recipients that are not our processors

| entity | when | data | role |
|---|---|---|---|
| Sold through Link, LLC (“Link”) and Stripe, LLC, USA; stripe.com/privacy, link.com/terms | the purchase of a subscription or a balance top-up | card details, billing and tax address, the email and name given at the checkout; payment history | separate controller; it makes the purchase data available to us in the dashboard (point 3 of the Privacy Policy)  |
| Google Ireland Limited, Ireland; policies.google.com/privacy | signing in with Google, when you choose it | Google identifier, email address, confirmation of the address, Workspace domain | separate controller (identity provider)  |
| Cloudflare, Inc., USA; cloudflare.com/turnstile-privacy-policy | the Turnstile challenge and a security challenge for part of the traffic | the data from these challenges (IP address, TLS fingerprint, browser) | separate controller for the purpose of improving bot detection |
| Slack Technologies Limited, Ireland (for workspaces outside the USA and Canada) or Slack Technologies, LLC, USA; slack.com/trust/privacy | only when the Organization turns on the integration | names of plans and projects, excerpts of questions of up to 300 characters, the person's display name | the Organization's processor, on its Slack account  |
| the provider of the model of a person's agent and every MCP client that a person or an Organization connects through a console or an automation key | only when a person or an Organization connects an agent | documents of plans, prompts and epics, projects, notes, questions and answers, names of people and of the Organization, which the agent retrieves through MCP or the API | a recipient chosen by the person or the Organization, under their own contract with the agent's provider |