legal

Sub-processors

Everyone who touches your data, and what for. Short because keeping it short is treated as a design constraint.

Version 0.3Effective 29 July 20263 min readTouch Grass AB

Published service documents. These pages describe the service as it is operated today. They are not a compliance certification and do not change a separately signed agreement; where one differs, that agreement controls.

This page is annex III to the data processing agreement. It is the complete list of parties Touch Grass AB engages to process customer data. There is no second list and no category of "affiliates" doing the same work under another name.

▸Contents — 4 clauses

1The list
2What leaves the EEA, and what never does
3Changes to this list
4Product telemetry

1The list#

Sub-processors, what each does, and where it sits
Sub-processor	What it does	What it can reach	Where
Supabase	Managed Postgres, authentication, file storage and server-side functions. The system of record.	All customer content and account data.	EU — Stockholm
Vercel	Serves the website and the application bundle, and applies the edge configuration.	No customer content. Request metadata, including IP addresses, in the ordinary course of serving a page.	Frankfurt (eu-central-1), pinned in the deployment configuration.
OpenRouter	Routes requests from the four AI features to a model provider.	The text sent by whichever feature was invoked.	Outside the EEA
Model providers, via OpenRouter	Perform the generation, the guideline reading, the compliance review or the claim analysis.	The same text. The model used is recorded against each generation and each release.	Varies by model. Outside the EEA.
Web search, via OpenRouter	Used by claim research only, to find the published source a claim is checked against.	The claim being checked and the sources you nominate.	Outside the EEA
Stripe	May take subscription payments and issue invoices when card billing is enabled for a customer. Checkout is Stripe-hosted, so card details are not handled by the product.	Your billing email, billing address, VAT number where you give one, and what you bought. No content, and no access to any brand, rule or record.	Outside the EEA (United States), under its own standard contractual clauses
Resend, for account invitations. Sign-in, recovery and email-change messages are sent by Supabase from the templates in this repository. Both handle the address and the contents of the message and nothing else.	Delivers sign-in links and account invitations.	Email addresses, and the contents of those messages.	Outside the EEA (United States), under its own standard contractual clauses
Google	Optional sign-in, and the Drive picker that reads one file you choose. Neither runs unless you use it.	Your email address and name when you sign in with Google; the single Drive file you select, which is read into your browser and never proxied through us.	Outside the EEA (United States), under its own standard contractual clauses
Microsoft	Optional sign-in with a Microsoft work or personal account.	Your email address. Nothing else, and no access to any brand, rule or record.	Outside the EEA (United States), under its own standard contractual clauses

If card billing is enabled, checkout runs on Stripe’s own pages and returns an identifier. The product is not designed to receive or store card number, expiry or security-code data.

2What leaves the EEA, and what never does#

2.1Never leaves: carousels and their versions, projects, brand kits, uploaded images and fonts, templates, account and workspace membership, invitations, review comments, and every export and generation record. All of it is stored and processed in Stockholm.

2.2Leaves only on an explicit action: the text handled by deck generation, brand-guideline reading, the deck compliance review, and claim research. Each is a button a person presses. None runs on save, on a schedule, or at export. Clause 7 of the data processing agreement sets out what is sent by each and what the transfer rests on.

2.3The deterministic rule engine — the part that produces a finding you can rely on as a fact — runs in your browser and sends nothing anywhere. The copy checker on /start is the same engine and is the easiest way to confirm that for yourself.

3Changes to this list#

An addition or replacement is announced by email to account owners at least 30 days before it begins processing. You may object on reasonable data protection grounds within that window, and if we cannot accommodate the objection you may terminate the affected part of the service without penalty. The version number at the top of this page changes with the list.

4Product telemetry#

We do not use advertising networks, session recording, heatmaps or a customer messaging widget. Before enabling an analytics processor, we will name it, its location and the bounded event data it receives in this list, and give account owners the notice and opportunity to object described above. That processor will not receive customer content, rules, findings, prompts, recipient addresses or payment data.

Sub-processors, version 0.3, effective 29 July 2026. Every agreement, and who you are contracting with, on the legal index.