Subprocessors
The companies that process customer data on our behalf, what for and where.
On this page
1. What a subprocessor is
A subprocessor is a third party that processes personal data for us so that we can provide the Services. We choose them carefully, give them only the data they need, and require them by contract to protect it and to use it only to provide their services to us. This list applies to the Services described in our Privacy Policy and to customer personal data covered by our Data Processing Addendum.
2. Infrastructure and hosting
| Subprocessor | What it does for us | Data involved | Location |
|---|---|---|---|
| Supabase, Inc. | Main database, sign-in, file storage and live updates for Co-Create; separate databases for the apps you build | All account data and content | United States |
| Netlify, Inc. | Hosting for co-create.build, aiaide.io, the Co-Create web app, and the previews and live sites of apps you build | Requests, content served, technical logs | United States, with a global delivery network |
| DigitalOcean, LLC | Servers that run background jobs, scheduled work and our AI assistant's processing and memory | Content processed by those jobs | United States |
| Modal Labs, Inc. | Isolated cloud sandboxes in which the apps you approve are built and tested | Your app's code and the build instructions | United States |
| GitHub, Inc. | Stores the code of the apps you build | Your app's code | United States |
| Cloudflare, Inc. | Domain name service and our status page | Technical request data | Global network |
3. AI model providers
| Subprocessor | What it does for us | Data involved | Location |
|---|---|---|---|
| Anthropic, PBC | AI models that plan, write code and answer | Prompts and the content a feature needs | United States |
| OpenAI, L.L.C. | AI models that answer, describe images and, as a fallback, transcribe audio | Prompts, content, images and audio a feature needs | United States |
| OpenRouter, Inc. | Routes AI requests to model providers when our primary route is unavailable | Prompts and the content a feature needs | United States |
We do not use your content to train our own models. Under the business terms we use, these providers do not use data sent through their APIs to train their models by default. See Section 5 of the Privacy Policy.
4. Payments
| Subprocessor | What it does for us | Data involved | Location |
|---|---|---|---|
| Stripe, Inc. | Web payments, saved payment methods and sales tax calculation | Name, email, billing details, payment card data (held by Stripe) | United States |
| RevenueCat, Inc. | Manages subscriptions and purchases made in our iPhone and Android apps | Account identifier, purchase records | United States |
| Apple Inc. | App Store purchases | Purchase records (Apple is the seller of record) | United States |
| Google LLC (Google Play) | Google Play purchases | Purchase records (Google is the seller of record) | United States |
5. Communications
| Subprocessor | What it does for us | Data involved | Location |
|---|---|---|---|
| Twilio Inc. | Text messages: verification codes, two-step sign-in and account alerts | Phone number, message content and delivery data | United States |
| Google LLC (Google Workspace) | Sends our emails and hosts our business email | Email address and message content | United States |
| Apple Inc. (Apple Push Notification service) | Push notifications to iPhones | Device token, notification content | United States |
| Google LLC (Firebase Cloud Messaging) | Push notifications to Android devices | Device token, notification content | United States |
6. Sign-in and analytics
| Subprocessor | What it does for us | Data involved | Location |
|---|---|---|---|
| Google LLC (Sign in with Google) | Optional sign-in | Name, email address | United States |
| Apple Inc. (Sign in with Apple) | Optional sign-in | Name, email or private relay address | United States |
| Google LLC (Google Analytics) | Measures use of the public co-create.build website, with advertising features off | Device and usage data, IP address (anonymized) | United States |
7. Other services we use
Some features fetch content from third parties without sending them your account details. For example, GIF search in Co-Create sends your search words to GIPHY from our servers. When you connect an outside service to an app you build (for example by adding an API key), that service is your provider, not ours, and its terms govern your use of it. Booking a consultation on aiaide.io uses Google Calendar.
8. Changes and notifications
We will update this page before a new subprocessor begins processing customer content. Business customers that have accepted our Data Processing Addendum can ask to be told about changes by email by writing to cyberdesigner@aiaide.io with the subject "Subprocessor updates", and may object as the Addendum describes.
Last reviewed October 28, 2026.