Agined is in restricted beta. At sign up or sign in, you have to provide the beta tester password you received or request one at preview@agined.com. Thank you.
Loading…
Sub-processors · GDPR Art 28 · transparency
Every vendor who touches your data. Listed.
We use as few vendors as we can, and list each one before it processes anything. Each entry below is bound by a written GDPR Art. 28 data processing agreement with a valid transfer mechanism and processes only the data its service needs. Purchases go through Avonao Billing (with Stripe as merchant of record) and sign-in through Avonao ID, both operated by Avonao, Inc. and listed on the Legal page. Customers are notified at least 30 days in advance of any addition; objections accepted via privacy@agined.com.
These are the vendors the service calls today, taken from the code. Rows marked “When configured” send nothing until that vendor is switched on. The same list is published at /.well-known/sub-processors.json.
Hosts and runs the whole service: compute (Workers), databases (D1, Durable Objects), object storage (R2), KV, queues, DNS and TLS, transactional email (Cloudflare Email Service), bot checks on sign-up (Turnstile) and AI triage of support messages (Workers AI).
Data categories
Account identifiers (name, email address)
Workspace content and audit records
Exports
Support messages
Request metadata (IP address, user agent)
Processing regions
The data zone chosen for the workspace: North America West, North America East, Western Europe, Eastern Europe, Asia-Pacific or Oceania
European zones use Cloudflare's EU jurisdiction for D1 and R2
Legal basis
GDPR Art. 28 — Cloudflare Data Processing Addendum with EU SCCs
Text-message approvals and voice calls for severity-1 escalations, sent from Agined's Twilio account to numbers a workspace registers. When configured.
Data categories
Phone number
Message text
Processing regions
United States
Legal basis
GDPR Art. 28 — Twilio Data Protection Addendum with EU SCCs
Centralized billing entity: checkout, subscriptions, invoices, payment methods and the billing portal for every purchase of the Service, with payments processed by Stripe. Card data is entered there only; Agined never receives it.
Data categories
Billing identity
Plan, status and renewal date
Invoices and tax details
Processing regions
United States
Legal basis
GDPR Art. 28 — Avonao data processing terms with EU SCCs
Merchant of record and payment processor for every purchase of the Service, processed via Avonao Billing: collects the price, calculates, collects and remits tax, and pays refunds. Card data is entered at Avonao Billing checkout only; Agined never receives it.
Data categories
Billing identity
Payment instrument metadata
Invoices and tax details
Processing regions
United States
Ireland
Legal basis
GDPR Art. 28 DPA + EU SCCs (Stripe data processing agreement)
Sole identity provider for sign-up and sign-in. Whatever sign-in methods a person uses at Avonao ID (including any third-party account connected there), Avonao ID receives and keeps them; Agined receives only the identity claims.
Data categories
Identifier, confirmed email address, name and language
Subscription state sent back (none, free or paid; renewal date)
Processing regions
The data region the person chose at Avonao ID (one of seven)
Legal basis
Independent controller for the account data it holds; claims exchanged under the Avonao agreement
Model inference as a Number One failover provider, used only when configured and when the primary is unavailable. Also website analytics (Google Analytics 4), only after a visitor allows Statistics.
Data categories
Conversation content
Workspace configuration named in a prompt
Pseudonymous browsing data (analytics, with consent)
Processing regions
United States
Legal basis
GDPR Art. 28 — Google Cloud data processing addendum with EU SCCs
Agined engages no third-party fraud-detection provider today; abuse checks such as the disposable-email blocklist run inside Agined. If a provider is ever added, it will be listed before it processes anything and will receive an envelope-only payload — never your workspace contents. The full list, including envelope fields and processing regions, lives at /security#fraud-detection with machine-readable parity at /.well-known/fraud-providers.json.
Machine-readable disclosure
Auditors, regulators, and AI agent partners can fetch /.well-known/sub-processors.json without authentication. The document mirrors this page and is generated by the codegen pipeline, so drift between the two surfaces is structurally impossible.
02
When this list changes
30 days' notice. Objection welcome.
Adding a new sub-processor — or materially changing how an existing one processes customer data — triggers a notice at least 30 days before the change takes effect. Notification channels: email to every workspace owner + a banner in the dashboard + a changelog entry on the DPA page. The same period is set in the DPA.
Customers may object via privacy@agined.com. If the objection cannot be accommodated (typically because the vendor is the only viable provider for the feature), customers may terminate without penalty per the DPA termination clause.
Before we add a sub-processor, it must sign a written data processing agreement with a valid transfer mechanism, need only the data its service requires, and fit the data-residency regions our customers choose.
