Subprocessors
Transparent list of vendors that process data when you use Quad Chat: AI model providers, hosting, analytics, and payment processors.
Last updated
October 14, 2026
Hosting, Database & Security
| Provider | Purpose | Region | Data |
|---|---|---|---|
| Vercel | Web hosting, delivery, bot protection, and AI Gateway routing | United States / global network | Request metadata, account-facing web traffic, prompts and outputs for managed AI requests |
| Convex | Application database, temporary/internal files, backend functions, and realtime sync | United States | Account, workspace, conversation, file, integration, usage, and service metadata |
| Cloudflare R2 / Workers | Private durable file storage and hosted experience delivery | Global network | User uploads, project sources, generated media, and app artifacts |
| Arcjet | Bot detection, rate limiting, and abuse prevention | United States | Source IP address, request metadata, account identifier, and email address for signup validation |
| Vercel Sandbox | Isolated execution of user-requested and generated code | United States / global network | Project sources, user files, and generated code for the duration of a run |
| Sentry | Crash and error monitoring | United States | Redacted error context, device and request metadata; default PII collection is disabled |
| Expo / EAS | Mobile application builds, updates, and delivery infrastructure | United States / global delivery | App build and update metadata; device request metadata when updates are checked |
Authentication
| Provider | Purpose | Region | Data |
|---|---|---|---|
| WorkOS AuthKit | User authentication (SSO/Email) | US/EU | Account identifiers, session metadata |
Payments
| Provider | Purpose | Region | Data |
|---|---|---|---|
| Polar | Subscriptions & billing | Global | Billing identifiers, subscription metadata |
| RevenueCat | Mobile in-app purchase entitlement and subscription synchronization | United States / global infrastructure | App user identifier, store product, purchase, entitlement, and subscription status |
| Apple App Store / Google Play | Mobile in-app purchases, subscription management, and store delivery | Global | Store account transaction, product, subscription, and app/device metadata governed by the applicable store account |
Customer Support
| Provider | Purpose | Region | Data |
|---|---|---|---|
| Intercom | Support Messenger and AI support assistance, loaded when you choose to open support chat | United States (default Messenger region) | Messages and contact details you choose to provide, browser and request metadata, and support-session cookies or local storage. Quad account details are not automatically passed to Messenger. |
Email & Notifications
| Provider | Purpose | Region | Data |
|---|---|---|---|
| Resend | Transactional email, privacy-request notices, and consented marketing email | United States | Name, email address, message content, and delivery metadata |
| Apple Push Notification service / Firebase Cloud Messaging | Mobile push notifications when enabled | Global | Push token, app/device metadata, and notification payload |
Analytics & Monitoring
| Provider | Purpose | Region | Data |
|---|---|---|---|
| Vercel Analytics | Aggregated usage analytics | Global | Anonymous/aggregated usage |
| Simple Analytics | Optional cookieless pageview analytics after consent | Netherlands | Redacted page paths and browser/device statistics. Referrers, URL parameters, page-load identifiers, scrolling and time-on-page collection are disabled |
| PostHog | Optional product analytics and metadata-only AI service telemetry | United States | Consented product usage events including account identifier, email address, and name; model, token, latency, and service metadata. Prompt and output capture is disabled by default |
| Axiom | Operational and reliability logging | United States | Structured service events, account identifier, and request metadata. Prompt and output content is not logged |
| Firebase Analytics (Google) | Optional mobile product analytics | United States / global | Consented mobile app events and account identifier. Automatic collection is disabled until consent is given |
| Expo Insights | Mobile application delivery telemetry | United States | App version and update adoption metadata |
| Google Ads (Google tag) | Ad conversion measurement (only with marketing-cookie consent) | Global | Conversion events, ad-click identifiers |
AI Inference & Search Infra
| Provider | Purpose | Region | Data |
|---|---|---|---|
| Vercel AI Gateway | Managed model routing; Zero Data Retention enforcement for Private Lane chat | Global | Prompts, relevant chat history, selected attachments, memory and instructions, limited plan or usage context, opaque service attribution identifiers, and model outputs |
Direct AI and additional tool recipients
| Provider | Purpose | Region | Data |
|---|---|---|---|
| Google Gemini API / Lyria | Direct music generation, when enabled after paid-processing verification | Google processing regions under its API terms | Music prompts, lyrics and generated audio. This direct route is outside Gateway ZDR; disabling interaction storage does not remove every safety or operational retention obligation. |
| Supadata (Dumpling Software UG) | YouTube transcript retrieval | Germany-based operator; processing infrastructure varies | Video identifiers, requested URLs and transcript results; its own caching and retention terms apply. |
| Telegram | Optional bot conversations and delivery of requested results | Telegram service infrastructure | Chat and user identifiers and message content sent to the bot. Bot chats are not end-to-end encrypted. |
| Vercel Connect and selected OAuth/MCP providers | Connection brokering and requested integration actions | Vercel and destination-provider regions | Connection identifiers, permissions, credentials and requested tool content. Downstream recipients depend on the selected integration. |
| Meta Pixel and Conversions API, if configured | Optional signup and purchase advertising measurement after current marketing permission | Meta global infrastructure | Ad-click and browser identifiers, browser user agent, hashed email and account identifier, and signup or purchase metadata. Hashing is pseudonymization, not anonymity; no workspace content is included. |
| TikTok Pixel and Events API, if configured | Optional signup and purchase advertising measurement after current marketing permission | TikTok global infrastructure | Ad-click and browser identifiers, browser user agent, hashed email and account identifier, and signup or purchase metadata. Hashing is pseudonymization, not anonymity; no workspace content is included. |
| Microsoft Advertising UET and Conversions API, if configured | Optional signup and purchase advertising measurement after current marketing permission | Microsoft global infrastructure | Ad-click identifiers, browser user agent, hashed email and account identifier, and signup or purchase metadata. Hashing is pseudonymization, not anonymity; no workspace content is included. |
LLM, Search & Connected Services (feature-selected / BYOK)
| Provider | Purpose | Region | Data |
|---|---|---|---|
| OpenAI, Anthropic, Google, xAI (Grok), Mistral, DeepSeek, Groq, Alibaba, Amazon, Meta, Microsoft, MiniMax, Moonshot AI, NVIDIA, Thinking Machines, Z.ai, ByteDance, Black Forest Labs, Recraft, Kling AI, Baseten, Prodia | Model inference for chat, image generation, video generation, and voice transcription | Global | Prompts, relevant chat history, user-selected attachments and instructions, voice recordings submitted for transcription, and outputs per request. Private Lane chat and voice transcription are sent with Zero Data Retention requested. Standard Lane chat requires an additional confirmation and may use the selected provider's standard retention terms. Image and video generation run on Standard Lane after a one-time in-app confirmation, with provider retention terms and no-training routing required; retention availability depends on the selected provider |
| Brave Search, Exa, Jina Reader, Serper, Instant Search API (instant.erzen.tk) | Web search, page retrieval, and research | Global | Search queries, the URLs a user asks the assistant to read, and derived results |
| OpenWeather, Finnhub, CoinGecko, Frankfurter | Utility lookups requested in a conversation | Global | The location, ticker, or currency pair contained in the request |
| Perplexity, Tavily | Web search, available only when a user supplies their own API key | Global | Queries and derived results, sent under the user's own account with that provider |
| GitHub, Google Workspace, Microsoft, Notion, Linear, Dropbox, Spotify, Slack, Todoist and user-configured MCP services | Optional tools and integrations selected by the user | Global | OAuth account details, requested tool inputs and outputs, and feature-specific content |
Contact
Questions or vendor requests? Contact privacy@quad.chat.
- Company: Quad Labs Technologies LLC
- Address: 1021 E Lincolnway 10208, Cheyenne, WY 82001, United States
- Phone: (650) 753-7081
- privacy@quad.chat