Legal
Products & data recipients
Service providers and subprocessors
Who receives data, for which product, and why.
Last updated:
A provider is listed for its applicable product and feature. Independent payment providers, customer-selected integrations and internal Gridheap platforms have different roles. A signed DPA determines subprocessor authorization, notices and objection periods; this page does not create a new universal DPA or notice period.
Bots.Pay · 15 provider assignments
Bots.Pay
Cloudflare
service provider- Purpose
- Website/application delivery, hosting and security as described for the product.
- Data
- Request metadata and the content needed for the stated hosting/security feature.
- Conditions
- Applies only to the named product and the described feature.
Bots.Pay
Adobe Fonts
font delivery provider- Purpose
- Font delivery and font-usage licensing.
- Data
- IP address and browser request information.
- Conditions
- Applies only to the named product and the described feature.
Bots.Pay
Clerk
service provider- Purpose
- Authentication and session management.
- Data
- Account identifiers, sign-in/session information.
- Conditions
- Applies only to the named product and the described feature.
Bots.Pay
Stripe
payment provider; independent controller for its own obligations- Purpose
- Payment processing.
- Data
- Payment/billing details and transaction records.
- Conditions
- Applies only to the named product and the described feature.
Bots.Pay
PayPal
payment provider; independent controller for its own obligations- Purpose
- Payment processing.
- Data
- Payment/billing details and transaction records.
- Conditions
- Applies only to the named product and the described feature.
Bots.Pay
Amazon Web Services
service provider- Purpose
- Bot compute (Fargate), snapshots (S3) and operational records.
- Data
- Bot workspaces, repository/files, account/billing records.
- Conditions
- Applies only to the named product and the described feature.
- Location
- Current Bots notice identifies EU Frankfurt for compute and snapshots; other processing locations require confirmation.
Bots.Pay
Sentry
service provider- Purpose
- Error monitoring through AI Runtime and RShift Sites.
- Data
- Technical/error metadata under the documented stripping configuration.
- Conditions
- Applies only to the named product and the described feature.
Bots.Pay
Twilio
service provider- Purpose
- Enabled SMS/messaging channel delivery.
- Data
- Messages, telephone numbers and delivery status.
- Conditions
- Applies only to the named product and the described feature.
Bots.Pay
Meta (WhatsApp)
channel provider; role depends on feature and applicable agreement- Purpose
- Enabled WhatsApp channel delivery.
- Data
- Messages, channel/contact identifiers and delivery status.
- Conditions
- Applies only to the named product and the described feature.
Bots.Pay
AI Runtime (airuntime.dev)
internal Gridheap platform; same legal entity- Purpose
- Gridheap internal model routing gateway.
- Data
- Applicable selected model input and usage records.
- Conditions
- Downstream external providers must be disclosed separately; an internal gateway is not a substitute for their names. See AI Runtime privacy information and AI Runtime service providers for downstream model processing.
Bots.Pay
AgentMQ
internal Gridheap platform; same legal entity- Purpose
- Gridheap internal tool execution.
- Data
- Tool inputs/outputs and usage.
- Conditions
- Applies only to the named product and the described feature.
Bots.Pay
TidyMessages
internal Gridheap platform; same legal entity- Purpose
- Gridheap internal messaging/storage platform.
- Data
- Applicable messages, channel identifiers and delivery records.
- Conditions
- Applies only to the named product and the described feature.
Bots.Pay
Microsoft Azure
service provider- Purpose
- Applicable internal AI Runtime managed model/privacy compute.
- Data
- Application content and technical records needed for the applicable feature.
- Conditions
- Only when the requested Bot route uses that managed deployment; Bot workspace compute and snapshots are on AWS.
Bots.Pay
DeepSeek
service provider- Purpose
- Model inference for all Bots.Pay model requests, serving DeepSeek V4.1 Flash through the official API and the internal AI Runtime gateway.
- Data
- Instructions, conversation context, repository code and file contents included in a model request; generated outputs and request/usage metadata.
- Conditions
- Hangzhou DeepSeek Artificial Intelligence Co., Ltd. receives the model-request data needed to generate responses through its official API. DeepSeek privacy information: https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html.
- Location
- DeepSeek's privacy notice describes processing and storage in the People's Republic of China.
Bots.Pay
PostHog
service provider- Purpose
- Optional analytics: anonymous page views on the bots.pay home and contact pages, and Apple Music Bot recommendation analytics and playback diagnostics.
- Data
- For page views, the page category, product name and random document-scoped identifiers. For Apple Music Bot, Apple catalog identifiers and listening events, playback error codes and timings, app and player versions, browser family and operating system, under a pseudonymous identifier. No names, email addresses, song titles, page URLs, IP addresses, IP-derived location or recordings.
- Conditions
- Only after the visitor allows optional analytics in Privacy settings; Apple Music Bot asks first in every region, and Global Privacy Control blocks both.
- Location
- US-hosted PostHog endpoint.
Processing locations depend on the service, enabled feature and selected deployment. Listed locations apply to the identified deployment, rather than every service offered by that provider. Our Privacy Policy explains international transfers and applicable safeguards.
Grid Heap, Inc. · 1111B S Governors Ave Ste 51059, Dover, DE 19904, United States. Questions: legal@gridheap.com.