{
    "$schema": "https://pocodot.ai/schemas/subprocessors-v1.json",
    "version": 1,
    "last_updated": "2026-05-12",
    "notification_window_days": 30,
    "subprocessors": [
        {
            "name": "Anthropic",
            "category": "ai_provider",
            "purpose": "Powers Pocodot's AI replies and reasoning. Your messages pass through Anthropic so we can respond.",
            "data_processed": [
                "message_content_in_transit"
            ],
            "data_retention": "30 days for abuse monitoring; never used for training",
            "no_training_contract": true,
            "added": "2024-09-01",
            "region": "United States",
            "url": "https://www.anthropic.com/legal"
        },
        {
            "name": "OpenAI",
            "category": "ai_provider",
            "purpose": "Backup AI provider for specific tasks (vision, audio).",
            "data_processed": [
                "message_content_in_transit"
            ],
            "data_retention": "30 days for abuse monitoring; never used for training",
            "no_training_contract": true,
            "added": "2024-09-01",
            "region": "United States",
            "url": "https://openai.com/policies/business-terms"
        },
        {
            "name": "Google Gemini",
            "category": "ai_provider",
            "purpose": "Powers meeting and video understanding.",
            "data_processed": [
                "audio_video_content_in_transit"
            ],
            "data_retention": "Per Google Cloud paid-tier terms; not used for training",
            "no_training_contract": true,
            "added": "2024-11-01",
            "region": "United States",
            "url": "https://cloud.google.com/terms"
        },
        {
            "name": "Composio",
            "category": "integration_platform",
            "purpose": "Connects Pocodot to your tools (Slack, Notion, Calendar). Routes API calls; never sees message content.",
            "data_processed": [
                "oauth_tokens",
                "tool_call_metadata"
            ],
            "data_retention": "Per Composio enterprise terms",
            "no_training_contract": true,
            "added": "2025-01-15",
            "region": "United States",
            "url": "https://composio.dev/legal"
        },
        {
            "name": "DigitalOcean",
            "category": "infrastructure",
            "purpose": "Hosts Pocodot's servers and databases (Singapore region).",
            "data_processed": [
                "all_tenant_data_at_rest"
            ],
            "data_retention": "Per Pocodot's data lifecycle (active + 30-day backup)",
            "no_training_contract": null,
            "added": "2024-08-01",
            "region": "Singapore",
            "url": "https://www.digitalocean.com/legal"
        },
        {
            "name": "Stripe",
            "category": "payments",
            "purpose": "Processes payments. Card details are tokenized by Stripe and never touch our system.",
            "data_processed": [
                "billing_email",
                "payment_token",
                "billing_address"
            ],
            "data_retention": "Per Stripe's standard terms (7+ years for tax/audit)",
            "no_training_contract": null,
            "added": "2024-09-01",
            "region": "United States / Ireland",
            "url": "https://stripe.com/legal"
        },
        {
            "name": "Resend",
            "category": "transactional_email",
            "purpose": "Sends transactional emails (sign-in, deletion certificates, notifications).",
            "data_processed": [
                "email_address",
                "email_body"
            ],
            "data_retention": "30 days for delivery logs",
            "no_training_contract": null,
            "added": "2024-09-01",
            "region": "United States",
            "url": "https://resend.com/legal"
        }
    ],
    "channels_not_subprocessors": {
        "note": "These are platforms YOU connect to Pocodot. Data flows through them to us via OAuth — they are not Pocodot's subprocessors.",
        "items": [
            "Slack",
            "WhatsApp",
            "Telegram",
            "Microsoft Teams",
            "Discord"
        ]
    }
}