{
  "schema": "qypu-subprocessors/1.0",
  "publisher": "[ENTITY NAME]",
  "status": "DRAFT - requires review by qualified counsel in each jurisdiction",
  "updated": "2026-10-10",
  "notice_period_days": 30,
  "policy": "https://qypu.ai/trust/subprocessors",
  "subprocessors": [
    { "name": "Vercel", "entity": "Vercel Inc.", "purpose": "Application hosting and serverless compute; AI Gateway routing to model providers", "data": ["All workspace data in transit", "Request logs"], "location": "United States (global edge)", "transfer": "EU SCCs; Data Privacy Framework (to confirm)", "retention": "Logs per Vercel plan (to confirm)", "status": "active", "added": "2026-10-10" },
    { "name": "Cloudflare", "entity": "Cloudflare, Inc.", "purpose": "DNS, TLS, edge security, staff access control (Access), and media object storage (R2)", "data": ["Request metadata", "Uploaded and generated media"], "location": "Global edge; R2 region to confirm", "transfer": "EU SCCs; Data Privacy Framework", "retention": "For the life of the workspace (media); short-lived (edge logs)", "status": "active", "added": "2026-10-10" },
    { "name": "Supabase", "entity": "Supabase, Inc.", "purpose": "Managed Postgres database", "data": ["Account data", "Workspace content", "Encrypted tokens", "Authorisation records"], "location": "Singapore (current; target region to be decided)", "transfer": "EU SCCs; UK Addendum; Swiss amendments", "retention": "For the life of the workspace, plus 35-day backups", "status": "active", "added": "2026-10-10" },
    { "name": "WorkOS", "entity": "WorkOS, Inc.", "purpose": "Customer sign-in, single sign-on, and multi-factor authentication", "data": ["Name", "Email", "Sign-in records"], "location": "United States", "transfer": "EU SCCs; Data Privacy Framework (to confirm)", "retention": "For the life of the account", "status": "active", "added": "2026-10-10" },
    { "name": "Anthropic", "entity": "Anthropic, PBC", "purpose": "Large language models (Claude) for drafts, Brand Kit plans, and Checks", "data": ["Prompts containing workspace content", "Model outputs"], "location": "United States", "transfer": "EU SCCs", "retention": "Per commercial terms; no training on our data; zero data retention to confirm", "status": "active", "added": "2026-10-10" },
    { "name": "fal", "entity": "Features & Labels, Inc. (fal.ai)", "purpose": "Image and video generation and editing", "data": ["Prompts", "Reference images", "Generated media"], "location": "United States", "transfer": "EU SCCs (to confirm)", "retention": "To confirm", "status": "active", "added": "2026-10-10" },
    { "name": "Upstash", "entity": "Upstash, Inc.", "purpose": "Rate limiting and short-lived counters", "data": ["IP addresses (hashed or raw, to confirm)", "Request counts"], "location": "Region to confirm", "transfer": "EU SCCs (to confirm)", "retention": "Minutes to hours", "status": "active", "added": "2026-10-10" },
    { "name": "Sentry", "entity": "Functional Software, Inc. (Sentry)", "purpose": "Error monitoring", "data": ["Error reports", "IP address", "Browser data"], "location": "United States (EU region available, to decide)", "transfer": "EU SCCs; Data Privacy Framework", "retention": "90 days (to confirm)", "status": "active", "added": "2026-10-10" },
    { "name": "ElevenLabs", "entity": "Eleven Labs, Inc.", "purpose": "Voice-over and audio generation (only with consent under the Voice and Likeness Consent Policy)", "data": ["Scripts", "Consented voice samples"], "location": "To confirm", "transfer": "To confirm", "retention": "To confirm", "status": "planned", "added": null },
    { "name": "OpenAI", "entity": "OpenAI, L.L.C. / OpenAI Ireland Ltd", "purpose": "Alternative language models (present in code)", "data": ["Prompts", "Outputs"], "location": "United States", "transfer": "To confirm", "retention": "To confirm", "status": "to-confirm", "added": null },
    { "name": "Google (Gemini)", "entity": "Google LLC / Google Ireland Ltd", "purpose": "Alternative language and image models (present in code)", "data": ["Prompts", "Outputs"], "location": "To confirm", "transfer": "To confirm", "retention": "To confirm", "status": "to-confirm", "added": null },
    { "name": "xAI", "entity": "X.AI LLC", "purpose": "Alternative language models (present in code)", "data": ["Prompts", "Outputs"], "location": "United States", "transfer": "To confirm", "retention": "To confirm", "status": "to-confirm", "added": null },
    { "name": "OpenRouter", "entity": "OpenRouter, Inc.", "purpose": "Model routing (present in code)", "data": ["Prompts", "Outputs"], "location": "United States", "transfer": "To confirm", "retention": "To confirm", "status": "to-confirm", "added": null },
    { "name": "Z.ai", "entity": "To confirm", "purpose": "Alternative language models (present in code)", "data": ["Prompts", "Outputs"], "location": "To confirm (possibly China)", "transfer": "To confirm", "retention": "To confirm", "status": "to-confirm", "added": null },
    { "name": "Ayrshare", "entity": "Ayrshare, Inc.", "purpose": "Social publishing API (present in code)", "data": ["Post content", "Channel identifiers"], "location": "United States", "transfer": "To confirm", "retention": "To confirm", "status": "to-confirm", "added": null }
  ],
  "not_subprocessors": [
    { "name": "Meta, TikTok, LinkedIn, Google (YouTube)", "reason": "Platforms you instruct us to publish to. They receive content under their own terms as independent controllers." },
    { "name": "Payment provider", "reason": "To be chosen; will be listed before billing starts." }
  ],
  "history": [
    { "date": "2026-10-10", "change": "First draft list published for review." }
  ]
}