Every party we use is named below. Two things are still being completed: the processing region for some entries, and the providers for speech. Those are marked, not omitted. Where a region is marked pending, treat the transfer disclosure for that entry as incomplete. Email delivery is now named; its region is still open, and is discussed in International transfers.
Sub-processors
These parties process personal data on our behalf, under contracts that restrict their use of it to providing services to us.
| Provider | Purpose | Processing location |
|---|---|---|
| Google Cloud | Cloud infrastructure, storage and backend services for the Services and your Kemory data | Switzerland (customers in the rest of the world); India (customers in India) |
| Groq | Large language model inference — generating requested outputs and the background processing that organises your memory | region pending |
| OpenRunner | Large language model inference | region pending |
| PostHog | Product usage analytics. Receives your account identity (email address, name and, where you gave one, phone number), your IP address and the approximate location derived from it, your browser and device type, and product events. Telemetry events never include the content of your conversations or memories. | European Union |
| Stripe | Payment processing on our instructions — charging your payment method and issuing invoices for the seller of record. Also processes transaction data as an independent controller for its own fraud-prevention, AML and regulatory-compliance purposes. See Payments below | region pending |
| Notion | purpose pending confirmation | region pending |
| SeKondBrain AI Labs FZCO | Our group billing affiliate — seller of record for your purchase, invoicing, collection and account administration (Terms clauses 4.0 and 4.3B, Business Terms clause 8.0) | United Arab Emirates |
| Speech providers | Speech-to-text and text-to-speech for Kora Voice | pending |
| Twilio SendGrid | Transactional and service email — account, waitlist, billing, support and security messages. Receives your email address, your name where the message uses it, and the content of the message itself. | region pending |
No content you put into the Services — User Content, Memory Data or Captured AI Conversations — is sent to our billing affiliate or to Stripe. Those parties receive account, billing and subscription data only.
Payments and seller of record
There is no merchant of record. No third party is interposed as the seller of your subscription.
SEKONDBRAIN AI LABS FZCO, our group billing affiliate, is the seller of record for your purchase: it holds the Stripe account, charges your payment method, issues your invoice, and is responsible for applicable taxes on the sale. It is listed above as a sub-processor and acts on our instructions.
Stripe is our payment service provider. It acts as our processor when it executes a payment on our instructions, and separately as an independent controller of transaction data for its own fraud-prevention, anti-money-laundering, sanctions-screening and regulatory-compliance purposes, under Stripe’s own privacy policy. It is not a party to your contract with us and is not the seller of record. See clauses 4.3B and 4.3C of the Terms of Service.
Your payment details are handled by Stripe. We receive transaction confirmations and subscription status, and we do not store full card or bank details.
International transfers
Data at rest is stored in the deployment region selected at organisation creation: Google Cloud Switzerland (rest of world) or Google Cloud India (customers in India). Transfers to Switzerland are covered by UK adequacy regulations.
Billing and account administration data is processed by our group affiliate in the United Arab Emirates. The UAE is not covered by a UK adequacy decision, so that transfer is made under an intra-group data transfer agreement incorporating the UK International Data Transfer Agreement, supported by a transfer risk assessment.
Transactional and service email is processed by Twilio SendGrid, which receives the recipient address and the content of the message. Its processing region is being confirmed with the provider — SendGrid operates in more than one region and the SMTP endpoint we use does not identify which applies to our account, so no region is stated here. Until it is confirmed, treat the transfer disclosure for this entry as incomplete.
Transfers to India, to the UAE, and any other restricted transfer — including processing by inference providers in other jurisdictions — are made under the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, with supplementary measures where appropriate. You may request details of the safeguards applicable to a specific transfer at privacy@sekondbrain.ai.
Changes to this list
Business customers give general written authorisation to the sub-processors listed on this page, under Schedule 1 §3 of the Business Terms.
We will give at least 30 days’ notice of an intended addition or replacement. A customer may object on reasonable data-protection grounds; if the objection cannot be resolved, that customer may terminate the affected Services with a pro-rata refund. We impose data-protection obligations on sub-processors materially equivalent to those in Schedule 1, and remain liable for their performance.
To be notified of changes, or to raise an objection, write to privacy@sekondbrain.ai.