Subprocessors
Effective October 13, 2026
What a subprocessor is
A subprocessor is a company Tidy uses to process customer data while running the service. Each one acts on our instructions, under our privacy commitments, and never for its own purposes.
Changes to this list
We update this page before a new subprocessor starts handling customer data. Questions or objections: [email protected].
The list
Where a company processes data is taken from its own published privacy documentation.
AI model providers
| Company | What it does | Where |
|---|---|---|
| Google (Gemini) | AI extraction and assistant features, including content imported through Google APIs, and rich image generation. | Google’s global data centers |
| Groq | Assistant model lanes. Transcribes live voice calls, and takes over meeting and recording transcription when our own servers are unavailable. | United States and other countries |
| Fireworks AI | Embeddings for search, including backup for our own embedding service. | United States |
| OpenAI | Configured as a backup for bulk extraction, speech, and images. It has no working credential and processes nothing today. | Not in use |
Infrastructure
| Company | What it does | Where |
|---|---|---|
| Amazon Web Services | Email delivery and intake, and encrypted backups. | United States |
| Google Cloud | Notifications that bring new Gmail messages into Tidy. | Google’s global data centers |
| Cloudflare | Carries web traffic to Tidy, and cookieless site analytics. It does not receive your stored content. | Global network |
Messaging, payments, and crash reports
| Company | What it does | Where |
|---|---|---|
| Telnyx | Sends and receives texts, and runs voice features. | United States and other countries |
| Stripe | Processes payments. Card details stay with Stripe. | United States and other countries |
| Sentry | Crash reports from the Android app, with device identifiers. Crash reporting is built in but turned off; current builds send nothing. | United States or Germany |
Tidy’s own servers, databases, and sync run on hardware we manage in the United States. They are the service itself, not subprocessors.
Accounts you connect
Google, Microsoft, Zoho, Todoist, and the other services you connect are not our subprocessors. You authorize them directly, and they handle data under your own agreement with them.
| Connection | What it gives Tidy |
|---|---|
| Mail, calendar, contacts, Drive files, and Meet recordings, under the permissions listed in the Privacy Policy. | |
| Microsoft | Mail and calendar. |
| Zoho | Mail and calendar. |
| Todoist | Task import. |
The same applies to a model provider you choose for your own endpoint or for a virtual employee that uses your provider account: it receives prompts and tool results under your own agreement with it.
Contact
Questions or objections about this list: [email protected].