This page lists the current sub-processors authorized under Napkin AI’s Data Processing Agreement. Napkin AI will post notice here at least ten (10) calendar days before a future addition or replacement and, for customers who subscribe, will send an email notification when this page changes.
Change log
- August 31, 2026 — Corrected and expanded the list to reflect providers already supporting the service, consolidated Google services under Google LLC, updated legal entity names, and corrected the description of AI-provider retention. Mailmodo was removed from this list because it supports Napkin-controlled marketing communications rather than processing Customer Personal Data under the DPA; it remains disclosed in the Privacy Policy. This disclosure correction does not represent the start of new processing. Customers may raise reasonable data-protection objections to the newly disclosed providers by September 10, 2026.
- April 2, 2026 — Initial publication of the public sub-processor list.
Subscribe to updates
Customers who would like to receive email notifications whenever this page is updated can subscribe via this subscription form.
Current sub-processors
The disclosure date is the date on which a provider first appeared on this public list. It is not necessarily the date on which Napkin AI first engaged the provider.
| Sub-Processor | Location | Processing Activity | Privacy Policy | First publicly disclosed |
|---|---|---|---|---|
| Google LLC | United States | Cloud hosting, storage, databases, authentication, bot protection, business intelligence, and AI model inference through Google Cloud and paid Gemini services | cloud.google.com/terms/cloud-privacy-notice | April 2, 2026 |
| OpenAI OpCo, LLC | United States | AI language and image model inference | openai.com/policies/privacy-policy | April 2, 2026 |
| Anthropic, PBC | United States | AI language model inference | anthropic.com/legal/privacy | August 31, 2026 |
| Intercom, Inc. | United States | Customer support and communication | intercom.com/legal/privacy | April 2, 2026 |
| Stripe, Inc. | United States | Payment processing, billing, and subscription administration | stripe.com/privacy | April 2, 2026 |
| Twilio Inc. (SendGrid) | United States | Transactional email delivery | twilio.com/legal/privacy | April 2, 2026 |
| Functional Software, Inc. d/b/a Sentry | United States | Error monitoring, crash reporting, and service diagnostics | sentry.io/privacy | April 2, 2026 |
| Cloudflare, Inc. | United States | Bot detection and account-protection services through Cloudflare Turnstile | cloudflare.com/privacypolicy | August 31, 2026 |
| Catamorphic Co. d/b/a LaunchDarkly | United States | Feature-flag evaluation and controlled product rollout | launchdarkly.com/policies/privacy | August 31, 2026 |
| ScaleKit, Inc. | United States | Enterprise single sign-on and domain-to-connection lookup | scalekit.com/legal/privacy-policy | August 31, 2026 |
| Bouncer Sp. z o.o. | Poland | Email-address deliverability verification during account registration | usebouncer.com/privacy-policy | August 31, 2026 |
AI-provider data handling
Napkin AI uses paid or commercial AI services and does not permit its AI inference sub-processors to use Customer Personal Data to train or improve their general-purpose models. Provider operational and safety retention can still apply and is different from model training.
- OpenAI: OpenAI API data is not used for model training by default. Standard abuse-monitoring retention and, for some API features, application-state retention of up to thirty days may apply unless request-level or approved account controls reduce it.
- Anthropic: Anthropic does not use commercial API inputs or outputs for model training by default. Standard API inputs and outputs may be retained for up to thirty days unless a separately approved zero-retention arrangement applies.
- Google: Paid Gemini and Google Cloud services do not use prompts or responses to improve Google products. Napkin AI has disabled Vertex AI prompt caching for its production project. Limited safety logging and feature-specific retention can still apply, including to uploaded files or search-grounded requests.
If you wish to object to a new or replacement sub-processor on reasonable data protection grounds, please contact [email protected] within ten (10) calendar days of the change being posted on this page.