Ikigai ADE - Subprocessors
Last updated: 2026-09-07 Applies to: All paid Ikigai ADE plans (Pro; Enterprise by negotiation). Ikigai ADE is the trading name of Mohamed Sidiyot, an individual trading as a sole proprietor in South Africa.
A "subprocessor" is a third-party service we use to process customer data on your behalf. POPIA Section 21 + GDPR Article 28 require disclosure.
This page is publicly hosted at /legal/subprocessors. We will email all active customers at least 30 days before adding a new subprocessor.
Core infrastructure
| Subprocessor | Purpose | Data processed | Location | DPA |
|---|---|---|---|---|
| Vercel Inc. | Webapp hosting + edge network | Request metadata, logs | Global (CDN) | https://vercel.com/legal/dpa |
| Supabase Inc. | Postgres database + auth + storage | Account, brain content, CRM, billing | US-East-2 (AWS) | https://supabase.com/legal/dpa |
| Cloudflare Inc. | DNS, CDN, Tunnel ingress | Request metadata, IP addresses | Global | https://www.cloudflare.com/cloudflare-customer-dpa/ |
| Paystack Payments Ltd. | Billing + subscription management | Name, email, billing address, card last-4 (tokenized) | Nigeria, South Africa, EU | https://paystack.com/dpa |
| GitHub Inc. | Source code + CI | Code only (no customer data) | US | https://github.com/customer-terms/github-data-protection-agreement |
| Better Stack (Logtail) | Logs + uptime + status page | Request metadata, error stack traces | EU (Germany) | https://betterstack.com/dpa |
LLM providers (per request)
Customer prompts are sent to one of these providers based on the model the customer selects. No persistent data is sent - only the in-flight prompt + context - and providers commit contractually not to train on customer data (see each DPA).
| Provider | Model(s) used | Location | Data retention | DPA / Privacy |
|---|---|---|---|---|
| Anthropic | Claude family (claude slot) |
US | Up to 30 days for abuse review; not used for training | https://www.anthropic.com/legal/dpa |
| OpenAI | GPT family (gpt4o slot) |
US | 30 days; opted out of training via API | https://openai.com/policies/data-processing-addendum |
Gemini Flash (gemini slot) |
US, EU | 30 days; not used for training | https://cloud.google.com/terms/data-processing-addendum | |
| Groq Inc. | Qwen lane (qwen3.8-27b, qwen3.6-27b). Managed, not BYOK-only |
US | Not retained per Groq Terms | https://groq.com/privacy-policy |
| Moonshot AI | Kimi (kimi slot, when routed natively) |
China | 30 days; check provider terms | https://moonshot.ai/privacy |
| DeepSeek | DeepSeek V4 (deepseek slot, when routed natively) |
China | 30 days | https://www.deepseek.com/privacy-policy |
| NVIDIA (NIM) | Nemotron, and platform-routed Gemma, Kimi and DeepSeek lanes. Does not host Qwen or GLM | US | Per NVIDIA AI Foundation terms | https://www.nvidia.com/en-us/about-nvidia/privacy-policy/ |
| xAI | Grok family (grok slot, direct API, not NIM-hosted) |
US | Per xAI API terms | https://x.ai/legal/privacy-policy |
| Zhipu AI | GLM (glm slot, BYOK only — no managed lane) |
China | Per provider terms | https://open.bigmodel.cn |
| Alibaba (DashScope) | Qwen (BYOK only; the managed Qwen lane runs on Groq) | Singapore (intl tier) | 30 days | https://www.alibabacloud.com/help/en/legal |
Model names change as providers publish new versions. The authoritative, always-current list of which slot routes to which provider is served at /api/model-health/summary; this table names the companies that may receive your prompts, which is what the disclosure obligation attaches to.
Sub-services
| Subprocessor | Purpose | Data |
|---|---|---|
| Telegram Messenger | Optional Telegram bot delivery (customer-configured) | Customer's outbound messages, chat IDs |
| Resend.com | Transactional email (signup, billing, invites) | Recipient email + email body |
| Twilio Inc. | Outbound and inbound SMS and voice; call recording | Recipient phone number, message body, call audio |
| ElevenLabs | Text to speech for voice agents | The text to be spoken |
| Google (Apps Script / Sheets) | Waitlist and contact-form lead capture. Submissions are copied to a Google Sheet. | Name, email, phone, country, company, website |
Right to object
Per POPIA Section 11(3) and GDPR Article 21, you may object to processing by any specific subprocessor. We will provide alternative routing where technically possible (e.g. exclude a specific LLM provider). Email mohamedsidiyot@gmail.com.
Sub-processor changes
Material changes to this list are notified at least 30 days in advance via email + this page. Material = adding a new processor or relocating data to a new jurisdiction.
Contact
Information Officer: Mohamed Sidiyot - mohamedsidiyot@gmail.com Registered with the Information Regulator (SA): registration not yet complete. Status is tracked in FOUNDER-GATES-CHECKLIST.md Gate 5 and this line is updated on the day it is issued.