Ikigai ADE - Subprocessors
Last updated: 2026-06-24 Applies to: All paid Ikigai ADE plans (Pro; Enterprise by negotiation).
A "subprocessor" is a third-party service we use to process customer data on your behalf. POPIA Section 21 + GDPR Article 28 require disclosure.
This page is publicly hosted at /legal/subprocessors. We will email all active customers at least 30 days before adding a new subprocessor.
Core infrastructure
| Subprocessor | Purpose | Data processed | Location | DPA |
|---|---|---|---|---|
| Vercel Inc. | Webapp hosting + edge network | Request metadata, logs | Global (CDN) | https://vercel.com/legal/dpa |
| Supabase Inc. | Postgres database + auth + storage | Account, brain content, CRM, billing | US-East-2 (AWS) | https://supabase.com/legal/dpa |
| Cloudflare Inc. | DNS, CDN, Tunnel ingress | Request metadata, IP addresses | Global | https://www.cloudflare.com/cloudflare-customer-dpa/ |
| Paystack Payments Ltd. | Billing + subscription management | Name, email, billing address, card last-4 (tokenized) | Nigeria, South Africa, EU | https://paystack.com/dpa |
| GitHub Inc. | Source code + CI | Code only (no customer data) | US | https://github.com/customer-terms/github-data-protection-agreement |
| Better Stack (Logtail) | Logs + uptime + status page | Request metadata, error stack traces | EU (Germany) | https://betterstack.com/dpa |
LLM providers (per request)
Customer prompts are sent to one of these providers based on the model the customer selects. No persistent data is sent - only the in-flight prompt + context - and providers commit contractually not to train on customer data (see each DPA).
| Provider | Model(s) used | Location | Data retention | DPA / Privacy |
|---|---|---|---|---|
| Anthropic | Claude Fable 5 + Claude Opus 4.8 | US | Up to 30 days for abuse review; not used for training | https://www.anthropic.com/legal/dpa |
| OpenAI | GPT-5.5 (gpt4o alias) |
US | 30 days; opted-out of training via API | https://openai.com/policies/data-processing-addendum |
| Google (DeepMind) | Gemini 2.5 Pro | US, EU | 30 days; not used for training | https://cloud.google.com/terms/data-processing-addendum |
| Groq Inc. | Llama 4, Kimi (BYOK only - platform routes via NIM) | US | Not retained per Groq Terms | https://groq.com/privacy-policy |
| Moonshot AI | Kimi K2.6 | China-based; routed via Groq when possible | 30 days; check provider terms | https://moonshot.ai/privacy |
| DeepSeek | DeepSeek V4 | China | 30 days | https://www.deepseek.com/privacy-policy |
| Nvidia (NIM) | Nemotron + platform-routed Llama, Kimi, DeepSeek, Qwen, GLM, Mistral (NIM-hosted) | US | Per Nvidia AI Foundation terms | https://www.nvidia.com/en-us/about-nvidia/privacy-policy/ |
| Alibaba (DashScope) | Qwen3 Max (BYOK only - platform routes via NIM) | Singapore (intl tier) | 30 days | https://www.alibabacloud.com/help/en/legal |
| Ollama (local) | Llama 3.1 8B | On-premises (founder's Mac) | Not transmitted off-device | N/A - local |
Sub-services
| Subprocessor | Purpose | Data |
|---|---|---|
| Telegram Messenger | Optional Telegram bot delivery (customer-configured) | Customer's outbound messages, chat IDs |
| Resend.com | Transactional email (signup, billing, invites) | Recipient email + email body |
Right to object
Per POPIA Section 11(3) and GDPR Article 21, you may object to processing by any specific subprocessor. We will provide alternative routing where technically possible (e.g. exclude a specific LLM provider). Email mohamedsidiyot@gmail.com.
Sub-processor changes
Material changes to this list are notified at least 30 days in advance via email + this page. Material = adding a new processor or relocating data to a new jurisdiction.
Contact
Information Officer: Mohamed Sidiyot - mohamedsidiyot@gmail.com Registered with the Information Regulator (SA): in progress (targeted Q3 2026)