Subprocessors and Service Providers
Last updated: August 22, 2026
Brilliminds FZC uses the providers below to operate pdfs.build. A provider only receives the data needed for its stated purpose. Optional providers receive data only when the related feature is configured or used. Depending on the processing, a provider may be our processor, our subprocessor when we process Customer Personal Data, or an independent controller under its own terms.
Infrastructure and operations
| Provider | Purpose and data | Primary processing location | Use |
|---|---|---|---|
| Contabo GmbH | Application compute and self-managed PostgreSQL and Redis; account, workspace, Customer Content, usage, and billing metadata. | Germany | Core |
| Cloudflare, Inc. | Pages hosting, CDN, DNS, edge security, cookieless web analytics, and R2 object storage for uploads, fonts, images, imports, and rendered documents. | Global edge network; R2 automatic placement | Core |
| Plus Five Five, Inc. (Resend) | Transactional email; recipient name and email address, message content, and delivery metadata. | United States | Account email and invitations |
| Functional Software, Inc. (Sentry) | Error and performance monitoring; error details, request route, browser/device information, and diagnostic context. Default PII collection and session replay are disabled in our SDK configuration. | United States or Germany, according to the configured Sentry project | Only when monitoring is enabled |
AI and research features
AI requests can include prompts, chat history, template source, schemas, sample data, uploaded or generated images, and outputs. The configured model and provider determine the route. Web search sends the search query and requested domain filters.
| Provider | Purpose | Primary processing location | When used |
|---|---|---|---|
| Vercel Inc. | AI Gateway routing, metering, caching, and delivery to the selected model provider. | United States / global infrastructure | When the Vercel AI Gateway route is used |
| Requesty Ltd | AI gateway routing to configured model deployments. Request logs may be retained for up to 30 days unless zero-data-retention terms are enabled. | Frankfurt, Germany | When the Requesty route is configured and used |
| OpenAI OpCo, LLC / OpenAI Ireland Ltd. | GPT model inference. | United States, Ireland, and supported regional deployments | When an OpenAI model is selected |
| Anthropic, PBC | Claude model inference. | United States and supported cloud deployments | When a Claude model is selected |
| X.AI LLC | Template name, description, and folder-organization suggestions. | United States | When suggestion or organization features are used |
| Amazon Web Services EMEA SARL | Bedrock inference for supported Claude models. | European Union regions, including Frankfurt | When a Bedrock-hosted model is selected |
| Microsoft Ireland Operations Limited | Azure inference for supported GPT models. | European Union regions, including Sweden Central | When an Azure-hosted model is selected |
| Google LLC | Gemini image generation and optional Google Fonts catalog/preview requests. | United States / global infrastructure | When image generation or Google Fonts features are used |
| AlphaAI Technologies Inc. d/b/a Tavily | Web search used by the assistant's research tool. | United States | When web search is used |
Billing and sign-in providers
| Provider | Role and data | Location |
|---|---|---|
| Polar Software, Inc. | Merchant of Record and billing service. Polar independently processes checkout and payment data under its buyer terms and privacy policy; we exchange customer, subscription, invoice, country, transaction, and metered-usage identifiers. | United States |
| Google LLC | Optional OAuth sign-in. Google provides the account identity information the user authorizes and acts under its own privacy terms. | United States / global infrastructure |
| GitHub, Inc. | Optional OAuth sign-in. GitHub provides the account identity information the user authorizes and acts under its own privacy terms. | United States / global infrastructure |
Changes and objections
Customers give general authorization for these subprocessors under ourData Processing Addendum. We will post intended additions or replacements here and, where the provider will process Customer Personal Data, notify the account owner at least 15 days before the change takes effect. A customer may object during that period on reasonable data-protection grounds by emailing[email protected].
Questions
For a copy of a provider's applicable transfer safeguards or questions about a specific data route, contact [email protected].