Sub-processors
Who else can see your data
Everyone we rely on to run the hosted service at lawpatch.studio, what they can reach, and what keeps the transfer lawful. We announce additions and changes here at least 30 days before they start processing.
Cloudflare, Inc.
their privacy terms- Purpose
- Edge network in front of the site and API: TLS, firewall, bot and abuse protection; Turnstile browser check when a new workspace is created
- Data reached
- IP address, request metadata, anything in a request body while it passes through; for Turnstile, browser signals collected by the check (no cookies)
- Location
- Global edge network; the data centre nearest the visitor
- Transfer basis
- Cloudflare Data Processing Addendum, part of Cloudflare's customer terms, incorporating the EU Standard Contractual Clauses with the UK Addendum; EU-US Data Privacy Framework
Vercel Inc.
their privacy terms- Purpose
- Application hosting, edge network, request logs
- Data reached
- IP address, request metadata, anything in a request body while it is being served
- Location
- United States (functions run in the US); edge processing in the region nearest the visitor
- Transfer basis
- EU Standard Contractual Clauses with the UK Addendum; KVKK standard contract under Art. 9
Google LLC (Firebase, Cloud Firestore, Firebase Authentication)
their privacy terms- Purpose
- Database, authentication, vector search; reCAPTCHA Enterprise for Firebase App Check; Cloud Tasks for scheduling scan analysis (scan identifiers only)
- Data reached
- Account e-mail and display name, workspace and project records, scan metadata, findings; for App Check, browser and interaction signals collected by reCAPTCHA
- Location
- United States — Firestore multi-region nam5; authentication is global
- Transfer basis
- EU Standard Contractual Clauses with the UK Addendum; EU-US Data Privacy Framework; KVKK standard contract under Art. 9
OpenAI, L.L.C.
their privacy terms- Purpose
- Analysis of derived scan signals; embeddings for precedent search; web search for case law
- Data reached
- Rule identifiers, repository-relative paths, line numbers, structure and dependency names, the project description and answers you enter, precedent search queries and, only when the customer enables snippet sharing, masked one-line snippets. For web case research, an anonymised statement of each of a scan's most severe issues — no paths, code or company name — which OpenAI's search tool turns into web searches
- Location
- United States
- Transfer basis
- OpenAI Data Processing Addendum, incorporating the EU Standard Contractual Clauses with the UK Addendum; KVKK standard contract under Art. 9
- Their retention
- Requests are sent with response storage switched off and API data is not used to train OpenAI's models. OpenAI may keep API inputs and outputs for up to 30 days to monitor abuse, then deletes them.
Mixpanel, Inc.
their privacy terms- Purpose
- Product analytics, only for visitors who allow it: page views, clicks, scroll depth and time on page on the public site, page names in the dashboard, session replay of public pages
- Data reached
- A random browser id and, once signed in, the account's internal id (never an e-mail address or name); page names, clicked elements without their text, browser, device, and country and city derived from the IP address, which Mixpanel then discards. Replays of public pages with every input and image masked
- Location
- United States
- Transfer basis
- Mixpanel's Data Processing Addendum under its terms of service, incorporating the EU Standard Contractual Clauses; EU-US Data Privacy Framework
- Their retention
- Session replays expire after Mixpanel's replay retention period (30 days by default). Withdrawing consent stops collection on that browser at once.
Running it yourself
The product is designed so that the list above can be shortened. Self-hosting the app removes our hosting and database from it, and pointing OPENAI_BASE_URL at a model you run yourself removes the model provider. The SDK never needs any of them: detection has always run on your machine.
Questions about a specific sub-processor: [email protected]. See also the data processing addendum.