nineloops
Legal
Sub-processors
PUBLSHR LTD uses the providers below to run nineloops. Each one is bound by a written agreement that covers confidentiality and data protection. We give 30 days notice before adding or replacing one that handles your workspace data. See the Data Processing Agreement, section 6.
Sub-processors that handle workspace data
| Provider | Purpose | Data it handles | Location now | Location planned |
|---|---|---|---|---|
| Supabase, Inc. (United States) | Database, file storage, sign-in, backend functions, scheduled jobs | All workspace data, account data, files, sign-in records | us-west-1, Northern California, United States | London, eu-west-2, United Kingdom |
| Vercel, Inc. (United States) | Hosting the web app and the marketing site; a few server functions (screenshots, Studio rendering, SMTP relay, WhatsApp webhook pass-through) | Page requests and IP addresses; the content a function handles while it runs (a page being screenshotted, a design being rendered, an outbound email passing through the relay) | Static pages served from Vercel's global network. Server functions run in Vercel's default region in the United States | No change |
| Stripe, Inc. (United States) and Stripe Payments Europe Ltd (Ireland) | Payments, invoices, VAT, billing portal | Billing name, email, address, VAT or tax ID, card details (card numbers never touch nineloops) | Stripe's own infrastructure, United States and Ireland | No change |
| Anthropic, PBC (United States) | Levi, the assistant; Brain, the AI employees; Studio AI; the screening of job applications you receive through your careers site; the chat widget on your website; column matching when you import a file | The content of the action you invoke: the message, document, record or conversation Levi is asked about, and the fields Levi needs to answer it; with every Levi request, your first name and workspace role, the workspace and company name, the names of the apps you use, the company rules you have taught Levi, and your brand kit when you have set one up. Levi chats are kept in your workspace so you can reopen them. What an AI employee is asked to do and the records it reads to do it; an application and its answers; a website visitor's chat; the headers and sample rows of a file being imported | United States | No change. Anthropic's commercial API does not train on this content |
| OpenAI, L.L.C. (United States) | Memory for Levi and Brain (text embeddings); the WhatsApp bot (understanding a customer's message, the setup assistant, the campaign agent); AI steps in Automations (summarise, classify, write); Studio image editing (enhance, inpaint, outpaint, grab); a voice reply for a Brain call if Anthropic does not answer | For memory: the name, title, email and stage of each CRM contact, company names and domains, deal titles and values, invoice numbers, clients and totals, retainer details, Levi briefings and the first 2,000 characters of each shared document; for the WhatsApp bot: every message a customer sends to a number you connect and the business details you give the bot; for Automations: the text the step acts on; for Studio: the image you edit; for a voice fallback: the conversation so far | United States | No change. OpenAI's commercial API does not train on this content |
| Amazon Web Services, Inc. (United States) | Simple Email Service, the last transport for email from nineloops itself (sign-in codes, invitations, billing and deletion notices) when the connected mailbox cannot send | The recipient's address and the content of that email | The AWS region set for the account, United States | No change |
| Apple Inc. (United States) | Push notifications to the iPhone app; signing and distributing the Mac and iPhone apps | For a push: the title and the text of the chat message being delivered, and the device token. For distribution: app binaries only | Apple's infrastructure, global | No change. Only when you install the iPhone app |
| Meta Platforms, Inc. (United States) and Meta Platforms Ireland Ltd | WhatsApp Business, Instagram and Facebook channels you connect | Messages, contacts and posts on the channels you connect. Meta is also an independent controller for its own platforms | Meta's infrastructure, United States and EU | No change. Only when you connect a channel |
| Google LLC (United States) | Gmail and Google Calendar you connect; Google Fonts on the marketing site; Google Public DNS as a fallback for domain checks; Google News for Monitoring | Mail headers, snippets and read state for the index; message bodies fetched on demand and not stored; calendar events; the IP address of a visitor loading a font; the domain name being checked; the search terms you set in Monitoring | Google's infrastructure, global | No change. Mail and calendar only when you connect a Google account |
| Microsoft Corporation (United States) and Microsoft Ireland | Outlook mail and calendar you connect | Same as Google, for a Microsoft account | Microsoft's infrastructure, global | No change. Only when you connect a Microsoft account |
| Cloudflare, Inc. (United States) | DNS lookups over HTTPS when verifying an email domain or sender | Only the domain name being checked. No personal data | Cloudflare's global network | No change |
Public services that receive a search term and nothing else
Monitoring and Studio search public sources. The only thing sent is the term you typed; no record from your workspace goes with it.
| Provider | Purpose | Data |
|---|---|---|
| Reddit, Inc. | Monitoring searches public posts | Your Monitoring search terms |
| RSSHub (public feed service) | Monitoring reads a few public news feeds through it | The feed address only |
| Openverse (Creative Commons) | Studio searches openly licensed images | Your Studio search terms |
| Have I Been Pwned (Troy Hunt) | Checks a new password against known breaches at sign-up | The first 5 characters of a hash of the password. The password itself, and your email, are never sent |
Providers that do not process workspace data
| Provider | Purpose | Data |
|---|---|---|
| GitHub, Inc. | Source code and the automated review workflow | Code only. No customer data |
Written into the code, not in use
These providers appear in nineloops's code and receive nothing today, because no key is set for them. If one is switched on, it moves to the table above with 30 days notice.
- Moz, Similarweb and BuzzSumo (coverage metrics)
- Fly.io (computers for AI employees)
- Resend (email)
Things that are not sub-processors
- Your own email provider. If you add your own SendGrid, Postmark, SES or SMTP account in Settings, Email, campaign mail is sent through it. That provider is your supplier, not ours.
- Speech to text. Voice input uses the speech recognition built into your browser or device. On Chrome that is Google's service and on Safari it is Apple's, under their terms, and nineloops does not receive the audio. In the Mac app, a Brain voice call can use a speech model that runs on your own computer. Audio is never sent to nineloops's servers, Anthropic or OpenAI.
- Screenshots. Monitoring screenshots are taken by nineloops's own browser on Vercel. No third-party screenshot service.
- Analytics. No third-party analytics or tracking scripts are loaded in the app or on the marketing site.
Data location, in one paragraph
Your workspace data (records, files, messages, sign-in details) is in the USA today: Northern California, United States, at Supabase. A move to London, United Kingdom, is planned. The web app itself is served by Vercel worldwide. Until the move, transfers from the UK and EU rely on the safeguards in the Data Processing Agreement, section 7. We will update this page and email workspace owners when the move is done. The longer version is at Where your data lives.
Changes to this list
| Date | Change |
|---|---|
| 28 September 2026 | First published |
| 28 September 2026 | Corrected against the code the same day: OpenAI's and Anthropic's rows now name every purpose and every kind of data; Amazon Web Services (email) and Apple (push notifications) added; the public search services and the providers written into the code but not in use listed; the speech to text note corrected. No provider started receiving data that it was not already receiving |
Contact
Questions about a provider on this list? Email hello@publshr.ae.