This page is an automatic translation, provided for convenience. The English version is the one that applies, unless the law where you live requires otherwise.
Subprocessors
Last updated: 30 באוקטובר 2026
Eternex, Inc. dba Syndai ("Syndai," "we") engages the third parties listed below (each a "Subprocessor") to process personal data on behalf of our customers in providing Syndai. This is the current Subprocessor list referenced by our Data Processing Addendum (the "DPA," Annex 3) and the Subprocessors and Third Parties section of our Privacy Policy.
Each Subprocessor processes data only on our documented instructions, is bound by written data-protection terms no less protective than our DPA, and may not use customer data for its own purposes. Our LLM Subprocessors are additionally, contractually barred from using customer content or output to train or improve their models.
Payments are not a Subprocessor activity: Polar (polar.sh) sells Syndai purchases as merchant of record and processes payment and tax data as an independent controller under its own terms. Sales on the sites and apps we host go to the customer's own Stripe account; Stripe processes those payments for the customer under Stripe's own terms, and Syndai is not the seller. Telegram is not a Subprocessor either: a customer who links Telegram talks to Syndai's Telegram bot through their own Telegram account, under Telegram's own terms.
Paid lookups by the chat and agents run within each agent's monthly limit (or the chat's limit per message) through DataForSEO, Apify and, through Monid, Fundable. Any other provider in Monid's catalog is used only after the customer approves a card that names the provider and shows the exact input; that provider is "the data provider named on each approval card." Agents never look up a person's email address or phone number.
| Subprocessor | Purpose | Location | Data terms |
|---|---|---|---|
| Cloudflare, Inc. | Hosting, CDN, DNS, and network security (WAF); also serves the sites and apps we host for customers and the question and feedback panel customers embed on their own sites, holds each app's member accounts and saved data, stores files and videos members upload to those apps, and counts their visits and link taps without cookies; receives mail sent to agents' watch addresses (Email Routing) and runs the browser sessions you open for Fill for me and the browser sessions an agent drives under its mandate (Browser Run); and receives the visit and tap counts and error reports of apps customers host elsewhere (Syndai Signals) | Global (US HQ) | Cloudflare Customer DPA |
| Supabase, Inc. | Managed database and authentication, including project notes, agents' chats and approval requests, and mail received at watch addresses; also stores form entries (signups, requests, orders) and feature requests from the sites and apps we host for customers; and the error reports of customers' sites and apps (Syndai Signals) | US / EU regions | Supabase DPA |
| Fly.io, Inc. | Application hosting | US / Global regions | DPA on request |
| E2B, Inc. | Isolated build sandboxes | US | Privacy policy; DPA on request |
| Modal Labs, Inc. | Isolated build sandboxes (compute) | US | Modal DPA |
| Anthropic, PBC | LLM provider executing requested changes, and feature-request text from the sites and apps we host for customers, which starts a coding run (barred from training on customer content) | US | Anthropic Commercial Terms |
| OpenAI, LLC | LLM provider executing requested changes, and feature-request text from the sites and apps we host for customers, which starts a coding run (barred from training on customer content) | US | OpenAI DPA |
| Google LLC | LLM provider executing requested changes, and visual design review of screenshots and page-derived text of the web app being built, which can show its signed-in pages, and feature-request text from the sites and apps we host for customers, which starts a coding run (barred from training on customer content); Google Cloud also hosts the per-workspace identities that read Search Console data for your sites, and Firebase Cloud Messaging delivers the notifications you turn on for a device | US | Google Cloud DPA |
| OpenRouter, Inc. | LLM request routing (routes requested changes, and design-review screenshots and page-derived text of the web app being built, and feature-request text from hosted sites and apps and from sites that embed our panel, with the page context the site attached, and form entries, for a reply draft when they arrive, never with the visitor's email address, and visitors' questions to a site's AI assistant, to the underlying model provider; and the AI features of the apps we host for customers, routed only to model providers that do not store or train on the data) | US | Provider terms |
| Replicate, Inc. | Media generation, engaged only when media generation is enabled for your account | US | Provider terms |
| fal.ai, Inc. | Media generation, engaged only when media generation is enabled for your account | US | Provider terms |
| Apify Technologies s.r.o. | Web data collection: reads public posts and profiles (Reddit, X, LinkedIn) that match your market, for the Grow tab's Threads and growth scan, and public LinkedIn and X posts for paid lookups by the chat and your agents. Data sent: search terms, company names and profile URLs | EU (Czech Republic) | Provider terms |
| Apollo.io (ZenLeads Inc.) | Prospect data for a growth scan and, when you tap Find contact, a person's email or phone. Data sent: search terms, company names and domains, and for Find contact a person's name, company domain or profile URL | US | Provider terms |
| DataForSEO OÜ | Business listings (local businesses and partners) for a growth scan, and business listings, domain rank and referring domains for paid lookups by the chat and your agents. Data sent: search terms (business category and place) and website addresses | EU (Estonia) | Provider terms |
| Findymail (Peanuts SaaS Studio) | Finds a person's email when you tap Find contact. Data sent: a person's name, company domain or profile URL | EU (France) | Provider terms |
| FullEnrich Corp | Finds a person's email or phone when you tap Find contact. Data sent: a person's name, company domain or profile URL | US | Provider terms |
| GBD Software as a Service Kft. (MillionVerifier) | Checks that an email found through Find contact is deliverable. Data sent: the email address | EU (Hungary) | Provider terms |
| ZeroBounce | Checks that an email found through Find contact is deliverable, when the first check is unsure. Data sent: the email address | US | Provider terms |
| Monid | Gateway that calls the data providers below for us, for a growth scan and Find contact, and for paid lookups by the chat and your agents, including the data provider named on each approval card you approve. Data sent: search terms, company names, profile URLs, and for Find contact a person's name, company domain or profile URL; for an approved lookup, the exact input shown on its card; when the chat searches Monid's catalog, only the search words | US | Provider terms |
| ContactOut (via Monid) | Finds a person's work or personal email, and phone, when you tap Find personal email or Find phone. Data sent: the person's LinkedIn profile URL | US | Provider terms |
| Ploid (via Monid) | People search and enrichment for a growth scan. Data sent: search terms, company names, profile URLs | US | Provider terms |
| Fundable (via Monid) | Recent funding of companies, as a signal for a growth scan and for funding-round lookups by the chat and your agents. Data sent: company domains | Not published; reached only through Monid (US) | Provider terms |
| Telnyx LLC | Answering calls forwarded to a site's phone line with an AI assistant (the caller's number, what the caller says, the message they leave), and an agent's calls to the businesses in its mandate and Connect me calls (the numbers dialled, a number lookup of the line type, and the call audio, transcribed and not recorded) | US | Provider terms |
| TypeSafe, engaged only when an agent uses a website for you or you run a growth scan | Choosing the next control to use on a page: the page's visible controls and text and the agent's goal; for a growth scan, scoring how well each company found fits your customer type: the company's public home-page text, your product line and the customer type; contractually barred from training on your content | US | Provider terms |
| SalesMap, engaged only when you run a Deep Value scan | Researching companies to sell to for a Deep Value scan: we send your app's site and description, your customer type and the roles you sell to, and the company domains already in your Grow list so it skips them; it reads those companies' public pages and uses its own providers (language models, company and job-post data) | US | Provider terms |
| Unipile (France; EU and US hosting), engaged only when you connect a mailbox, calendar or LinkedIn account | Connecting your Gmail, Outlook or IMAP mailbox and calendar through Unipile's sign-in, reading the threads with the contacts in an agent's mandate and sending its replies from your address; for a LinkedIn account you connect, it sends the connection requests and messages you launch, and reads reactions and comments on your posts; we do not keep your mailbox or LinkedIn password | EU (France); EU and US hosting | Provider terms |
| Smartlead, engaged only when you turn on Send | Warms the mailboxes InboxKit creates, sends the campaigns you launch, and returns replies, bounces and opt-outs | To be confirmed | Provider terms |
| InboxKit, engaged only when you turn on Send | Registers the sending domain and creates its mailboxes | To be confirmed | Provider terms |
| Resend, Inc. | Transactional email, including sign-in emails and notifications to members of the apps we host for customers and notices of form entries to those sites' owners | US | Provider terms |
| PostHog, Inc. (EU cloud) | Product analytics | EU | Provider terms |
| Functional Software, Inc. (Sentry) | Error monitoring | US | Provider terms |
Change notification
We give customers at least 30 days' notice before adding or replacing a Subprocessor that processes customer content, by email to the customer's notice address or by in-product notice, consistent with DPA section 5.2. During that period, a customer may object in writing on reasonable data-protection grounds; we will work in good faith to resolve the objection, and if we cannot, the customer may terminate the affected Order Form as its exclusive remedy under the DPA.
To subscribe to Subprocessor-change notifications, or for questions about this list, email privacy@syndai.ai.