Skip to content
Legal

Subprocessors

The providers that process data on behalf of notdocs.

Last revised

On this page

The list

These are the providers that process data on our behalf when you use the hosted service. Each one receives only what the purpose column says.

ProviderPurposeWhat it receivesLocation
Vercel Inc.Hosting of the website, the API and the MCP endpoint; file storage for uploaded assets; the AI Gateway that routes model calls; the Domains API for custom domainsEvery request to notdocs.dev; uploaded assets; the text sent to AI modelsUnited States company; functions run in Stockholm, Sweden
CapyDBManaged Postgres database and key-value storeAccounts, organizations, projects, memberships, hashed tokens, the document index and version texts, assistant stream pointersAsk us before you rely on a location
Clerk, Inc.Sign-in and session managementYour email address, sign-in credentials and sessionUnited States
Polar Software Inc.Billing for paid plans, as merchant of record; checkout, invoices and the billing portalThe organization's id and name, the buyer's email address, billing name and address, VAT id, and the payment details Polar collects itself (card details go to Polar's payment processor, never to us)United States
Functional Software, Inc. (Sentry)Error tracking for the website and the APIExceptions with the request that raised them: route, timing, the account id and browser details. Never document text, prompts or answersUnited States; Sentry offers a European Union data region, which is the one we use when the project is created
GitHub, Inc.Reading and committing repository content through the GitHub App you installThe documents and comments in the repositories you connectUnited States
The provider of the AI model you choose, through Vercel AI GatewayGenerating assistant answers, inline rewrites and search embeddingsThe text described in the AI disclosure. Defaults: DeepSeek for answers and rewrites, OpenAI for embeddingsDepends on the model

Changes to this list

We add a provider only when the service needs it. Before a new subprocessor handles personal data, we update this page and, if you have signed the data processing agreement, we email the organization's owners at least 14 days in advance so you can object. To be notified even without a DPA, write to privacy@notdocs.dev and ask to be added to the notification list.