Subprocessors
- Version
- 1.2
- Effective
- Cited as
- legal:subprocessors@1.2
This is the complete list of third parties that receive data from the mAInCharacter platform, what each one receives, and on what basis. It covers the public site, the booking flow, the client portal, and the desktop application a consultant runs during a session.
It is written from the code rather than from intention. Where a control is enforced somewhere a reader could in principle check — a database function, a Content-Security-Policy header, a type — this list says so, because a claim about a subprocessor is worth exactly as much as the mechanism behind it.
Always in the path
These receive data in the ordinary running of the platform.
| Subprocessor | What it receives | Basis and gate |
|---|---|---|
| Supabase — database, authentication, file storage | Everything the platform stores durably: your account identity and email address, your case record, session transcripts and the notes drawn from them, documents you upload and the text extracted from them, the per-case alias map (encrypted), your consent history, and booking records. | Processor acting on our instruction. It is the platform's sole system of record. Every table is governed by row-level security; uploaded files sit in a private bucket and are reachable only through short-lived signed URLs, never from the public origin. |
| Vercel — hosting | Every request to the site and to the portal passes through Vercel in transit: your IP address, user agent, the URL you asked for, and the body of the request and response. Vercel also runs the two scheduled jobs that expire quarantined material and remove orphaned files. | Hosting provider. Nothing is stored at Vercel that is not also in Supabase. |
The de-identification service (gline-rs, run by us) | Text being de-identified, one request at a time, for the sole purpose of finding names, places, organisations and similar identifiers in it. | Not a vendor — we run it ourselves, in our own container, with its models pinned by digest and verified at startup. It is listed because client text crosses a process boundary to reach it. It holds no alias map, no database handle, and no case context, so it cannot connect the text it sees to a person or a case. |
In the path only under a recorded grant
| Subprocessor | What it receives | Basis and gate |
|---|---|---|
| Anthropic — Claude, Message Batches API | The complete bytes of an uploaded PDF, exactly as uploaded, and the Markdown it reads back out. Nothing is removed first, because a PDF has no text to remove until a model has read it. | An explicit, recorded exception. A named consultant on your case grants egress on one document with a stated reason; the grant is written to the artifact row and audited like any other administrative act; nothing can be submitted without it. There is no blanket form of the grant — a second PDF needs a second grant. What comes back is visible to consultants only, and cannot become retrievable case material until it has been through de-identification. |
.docx, .md and .txt uploads are read on our own server and never leave
it. Only PDF crosses.
Optional, and off unless configured
| Subprocessor | What it receives | Basis and gate |
|---|---|---|
| Resend — transactional mail | Your name and email address, any guest addresses you added, the time and type of the meeting, the note you typed into the booking form, and the calendar attachment. | Sending the confirmation you asked for by booking. With no mail provider configured the platform sends nothing at all: the booking is already durable and its confirmation page carries the same details and the same reschedule link. |
| Cloudflare — Turnstile | The challenge token from the widget and, when our proxy supplies one, your IP address. No field of the booking form is sent. | Abuse protection on the only form a stranger can reach. Off unless a site key is configured; when it is configured and the secret is missing, bookings are refused rather than waved through. |
| Google Analytics 4 / Google Tag Manager | Currently nothing. The marketing pages carry a GA4 loader that runs only when a measurement ID is set, and no measurement ID is set — the value is null in every published page, so no request to Google is made. | Listed because the capability ships and our Content-Security-Policy permits the origins. If it is ever switched on, this document changes first. |
Chosen per device, and outside the platform's de-identification path
A consultant's desktop application can be configured — by them, or by a
Coaching Mode preset the practice publishes — to use a cloud provider for two
things: generating the suggestions a consultant sees during a session, and
computing the search vectors that surface prepared material. The shipped
default for both is an OpenAI-compatible server at a loopback address
(127.0.0.1) on the consultant's own machine, so out of the box neither
reaches anything outside it.
Where a cloud provider is selected, this is what happens, stated plainly because it is the exception to everything else on this page. The platform's de-identification pass runs after check-in and does not stand here; a weaker pass on the device does. It replaces the names it already holds — those on the checked-out case and in the material prepared for it — along with email addresses, phone numbers, web links, and runs of six or more digits, and it abandons the request rather than send text it could not clean. It is literal matching against a list, not a trained recogniser: anyone it was never told about is sent as spoken, and so are addresses, dates, ages, job titles, and employers. Read the "what it receives" column with that limit in mind.
| Subprocessor | What it receives | Basis and gate |
|---|---|---|
| OpenRouter | The live transcript window, the full session transcript when notes are generated, and the text of any prepared material the session drew on — with the known names and the pattern-matched identifiers replaced by stand-ins, and everything else as spoken and as written. | Selected configuration. The platform's de-identification pass runs after check-in and does not stand between the device and this provider; the device pass described above does, and is partial. |
| Voyage AI | The live transcript window and the text of prepared knowledge-base material, as embedding inputs — through the same partial device pass. | Selected configuration, same position as above. |
| An OpenAI-compatible endpoint you supply | The same content as OpenRouter. The shipped default for this setting is a local address (127.0.0.1), so it is only a subprocessor if a URL pointing off the machine is entered. | Selected configuration. |
| A local Codex CLI | The same content, handed to a command-line tool on the consultant's own machine. What that tool then does with it is governed by whoever installed it and is not observable from our code. | Selected configuration. |
We are naming these rather than leaving them out. If your engagement is run with a cloud provider selected, ask and we will tell you which one; if you would rather it were not, say so and the practice will run the local providers, which is the default.
Model and software downloads
The desktop application downloads its speech and diarisation models from Hugging Face, and two open-source binaries from their GitHub release pages, and checks GitHub for a newer version of itself. All four are anonymous requests for public files. No account identifier, no credential, and no session content is attached to any of them.
What is deliberately not a subprocessor
Worth stating, because each of these was once true of the site and is not any more, and because each removal is checkable rather than merely claimed:
- No scheduling vendor. Booking is ours end to end. The calls-to-action in the marketing pages point at our own booking route, and our Content-Security-Policy no longer permits any scheduling vendor's origin — which is what makes the removal verifiable rather than tidy.
- No third-party form handler. The contact form's endpoint is unset, and
the marketing surface is served with
form-action 'none', so a form on any of those pages cannot POST anywhere at all. - No speech-to-text vendor. Transcription and speaker separation run inside the desktop application as local models. There is no cloud transcription provider in the product, configurable or otherwise.
- No analytics, telemetry, crash reporting, or session replay in the desktop application. None is present in the code.
- No advertising or marketing platform anywhere.
Changes to this list
Adding a subprocessor means editing this file, which means a commit, a review, and a new version number at the top of this page. There is no administrative screen that can add one, because there is no content management system behind these pages at all — they are compiled into the site at build time.