The list
These are the providers that process data on our behalf when you use the hosted service. Each one receives only what the purpose column says.
| Provider | Purpose | What it receives | Location |
|---|---|---|---|
| Vercel Inc. | Hosting of the website, the API and the MCP endpoint; file storage for uploaded assets; the AI Gateway that routes model calls; the Domains API for custom domains | Every request to notdocs.dev; uploaded assets; the text sent to AI models | United States company; functions run in Stockholm, Sweden |
| CapyDB | Managed Postgres database and key-value store | Accounts, organizations, projects, memberships, hashed tokens, the document index and version texts, assistant stream pointers | Ask us before you rely on a location |
| Clerk, Inc. | Sign-in and session management | Your email address, sign-in credentials and session | United States |
| Polar Software Inc. | Billing for paid plans, as merchant of record; checkout, invoices and the billing portal | The organization's id and name, the buyer's email address, billing name and address, VAT id, and the payment details Polar collects itself (card details go to Polar's payment processor, never to us) | United States |
| Functional Software, Inc. (Sentry) | Error tracking for the website and the API | Exceptions with the request that raised them: route, timing, the account id and browser details. Never document text, prompts or answers | United States; Sentry offers a European Union data region, which is the one we use when the project is created |
| GitHub, Inc. | Reading and committing repository content through the GitHub App you install | The documents and comments in the repositories you connect | United States |
| The provider of the AI model you choose, through Vercel AI Gateway | Generating assistant answers, inline rewrites and search embeddings | The text described in the AI disclosure. Defaults: DeepSeek for answers and rewrites, OpenAI for embeddings | Depends on the model |
Changes to this list
We add a provider only when the service needs it. Before a new subprocessor handles personal data, we update this page and, if you have signed the data processing agreement, we email the organization's owners at least 14 days in advance so you can object. To be notified even without a DPA, write to privacy@notdocs.dev and ask to be added to the notification list.