Legal
Products & data recipients
Service providers and subprocessors
Who receives data, for which product, and why.
Last updated:
A provider is listed for its applicable product and feature. Independent payment providers, customer-selected integrations and internal Gridheap platforms have different roles. A signed DPA determines subprocessor authorization, notices and objection periods; this page does not create a new universal DPA or notice period.
Tokens.Pay · 12 provider assignments
Tokens.Pay
Cloudflare
service provider- Purpose
- Website/API delivery, security and the application storage or queues used by the selected feature.
- Data
- Technical requests, IP addresses and applicable application content.
- Conditions
- Applies only to the named product and the feature described here.
Tokens.Pay
Adobe Fonts
font delivery provider- Purpose
- Delivery and licensing of hosted interface fonts.
- Data
- IP address and browser request information; no application file contents.
- Conditions
- Applies only to the named product and the feature described here.
Tokens.Pay
Clerk
service provider- Purpose
- Authentication, session management and applicable organization membership.
- Data
- Account, sign-in, profile and session identifiers.
- Conditions
- Applies only to the named product and the feature described here.
Tokens.Pay
Stripe
payment provider; independent controller for its own obligations- Purpose
- Checkout, payments and related billing administration.
- Data
- Billing/contact information, payment credentials and transaction records.
- Conditions
- Applies only to the named product and the feature described here.
Tokens.Pay
PayPal
payment provider; independent controller for its own obligations- Purpose
- Payments and related transaction administration.
- Data
- Payment/account information and transaction records.
- Conditions
- Applies only to the named product and the feature described here.
Tokens.Pay
Sentry
service provider- Purpose
- Application error and performance monitoring.
- Data
- Technical/error and performance metadata, including identifiers permitted by the product’s diagnostic settings.
- Conditions
- Applies only to the named product and the feature described here.
Tokens.Pay
OpenAI
service provider- Purpose
- Selected text, image, embedding or audio model processing through AI Runtime.
- Data
- Inputs and context submitted to the selected model feature and its output.
- Conditions
- Applies only to the named product and the feature described here.
Tokens.Pay
DeepSeek
service provider- Purpose
- Selected DeepSeek models through the direct provider API.
- Data
- Model request inputs, context and output.
- Conditions
- Only a direct DeepSeek API route. A DeepSeek model served by Fireworks sends model data to Fireworks instead; route and fallback selection determine the recipient.
Tokens.Pay
Fireworks AI
service provider- Purpose
- Hosting selected model requests through AI Runtime.
- Data
- Model request inputs, context and output.
- Conditions
- Only a selected Fireworks-hosted model route, including the documented DeepSeek peak/fallback paths. Model branding alone does not identify the host.
Tokens.Pay
Moonshot AI
service provider- Purpose
- Selected Kimi model requests through AI Runtime.
- Data
- Model request inputs, context and output.
- Conditions
- Only a purchased/selected Kimi route; account and billing records are not sent as model context.
Tokens.Pay
AI Runtime (airuntime.dev)
internal Gridheap platform; same legal entity- Purpose
- Internal model routing, selected compute and usage accounting.
- Data
- Applicable model inputs/outputs, authorized configuration and usage records.
- Conditions
- Internal processing within Gridheap. The external hosting or delivery company is disclosed separately. See AI Runtime privacy information and AI Runtime service providers for downstream model processing.
Tokens.Pay
RShift Sites
internal Gridheap platform; same legal entity- Purpose
- Internal product website/API hosting and applicable project storage.
- Data
- Applicable website/API requests, project records and support submissions.
- Conditions
- Internal processing within Gridheap. The external hosting or delivery company is disclosed separately.
Processing locations depend on the service, enabled feature and selected deployment. Listed locations apply to the identified deployment, rather than every service offered by that provider. Our Privacy Policy explains international transfers and applicable safeguards.
Grid Heap, Inc. · 1111B S Governors Ave Ste 51059, Dover, DE 19904, United States. Questions: legal@gridheap.com.