Every party we use is named below. Two things are still being completed: the processing region for some entries, and the providers for speech and email delivery. Those are marked, not omitted. Where a region is marked pending, treat the transfer disclosure for that entry as incomplete.
Sub-processors
These parties process personal data on our behalf, under contracts that restrict their use of it to providing services to us.
| Provider | Purpose | Processing location |
|---|---|---|
| Google Cloud | Cloud infrastructure, storage and backend services for the Services and your Kemory data | Switzerland (customers in the rest of the world); India (customers in India) |
| Groq | Large language model inference — generating requested outputs and the background processing that organises your memory | region pending |
| Concentrate.ai | Large language model inference | region pending |
| OpenRunner | Large language model inference | region pending |
| PostHog | Product usage analytics. Telemetry events never include the content of your conversations or memories. | region pending |
| Paddle | Payments. Also acts as our merchant of record — see Payments below | region pending |
| Stripe | Payment processing | region pending |
| Notion | purpose pending confirmation | region pending |
| SeKondBrain AI Labs FZCO | Our group billing affiliate — invoicing, collection and account administration, acting as billing and collection agent (Terms clause 4.0, Business Terms clause 8.0) | United Arab Emirates |
| Speech providers | Speech-to-text and text-to-speech for Kora Voice | pending |
| Email delivery | Transactional and service email | pending |
No content you put into the Services — User Content, Memory Data or Captured AI Conversations — is sent to our billing affiliate, to Paddle or to Stripe. Those parties receive account, billing and subscription data only.
Payments and merchant of record
Paddle has two roles, and it is worth separating them.
For the subscription and account data we pass to it in order to bill you, Paddle acts on our instructions and is listed above as a sub-processor.
For the transaction itself, Paddle is our merchant of record: it is the seller of record, charges your payment method, handles applicable taxes, issues invoices and processes refunds. In that capacity it determines its own purposes — tax compliance, fraud prevention, its own record-keeping — and acts as an independent controller under its own privacy policy. See clause 4.3B of the Terms of Service.
We receive transaction confirmations and subscription status. We do not store full card numbers.
International transfers
Data at rest is stored in the deployment region selected at organisation creation: Google Cloud Switzerland (rest of world) or Google Cloud India (customers in India). Transfers to Switzerland are covered by UK adequacy regulations.
Billing and account administration data is processed by our group affiliate in the United Arab Emirates. The UAE is not covered by a UK adequacy decision, so that transfer is made under an intra-group data transfer agreement incorporating the UK International Data Transfer Agreement, supported by a transfer risk assessment.
Transfers to India, to the UAE, and any other restricted transfer — including processing by inference providers in other jurisdictions — are made under the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, with supplementary measures where appropriate. You may request details of the safeguards applicable to a specific transfer at privacy@sekondbrain.ai.
Changes to this list
Business customers give general written authorisation to the sub-processors listed on this page, under Schedule 1 §3 of the Business Terms.
We will give at least 30 days’ notice of an intended addition or replacement. A customer may object on reasonable data-protection grounds; if the objection cannot be resolved, that customer may terminate the affected Services with a pro-rata refund. We impose data-protection obligations on sub-processors materially equivalent to those in Schedule 1, and remain liable for their performance.
To be notified of changes, or to raise an objection, write to privacy@sekondbrain.ai.