These are the companies that process personal data for Gramdesk, in two groups. The first table lists our subprocessors of End-user data — the messages, comments and profiles of the people who interact with Customers' Instagram accounts — under the Data Processing Addendum: each is bound by data protection terms, and changes to this table are announced 30 days ahead. The second table lists other providers, which receive Customers' own account data or website visitors' data, but never End-user data — except Telegram, which receives messages only if a Customer connects its own Telegram chat for escalations. Each provider receives only what it needs for the purpose shown. Google Analytics and Yandex Metrica receive data only from website visitors who accept analytics.
Subprocessors of End-user data
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Amazon Web Services, Inc. | Hosting: servers, database, file storage, cache, logs, content delivery | All Service data | Sweden (Stockholm); content delivery from edge locations worldwide |
| Google LLC — Gemini API | AI features and text search (embeddings), via the paid API — the AI provider in use today | The text of messages, comments, captions and other content an AI feature works on (§ 4 of the Privacy Policy); no images | United States |
| OpenAI, L.L.C. | AI features (via API) — used only when we enable it; not in use today | When enabled: the text of messages, comments, captions and other content an AI feature works on (§ 4 of the Privacy Policy); no images | United States |
| Anthropic, PBC | AI features (via API) — used only when we enable it; not in use today | When enabled: the same kind of text as Google Gemini; no images | United States |
| Functional Software, Inc. (Sentry) | Error monitoring and session replays of errors | Error reports and performance traces, without the identity of the user; in the console, a recording of the moments before an error; on the website, session recordings only with the visitor's consent; all text, input and images masked in the browser | European Union (Germany) |
Other providers
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Google LLC — Firebase Authentication | Sign-in | Email address, name, password (stored hashed by Google), Google account identity | United States |
| Resend | Transactional email | Recipient address and the email's content: team invitations (inviter and workspace name), email verification and password-reset links | United States |
| Eskiz (eskiz.uz) | SMS | Phone number and the SMS text: confirmation codes, and notices about a trial ending, a failed payment or a suspended subscription | Uzbekistan |
| Atmos (atmos.uz) | Card payments in UZS | Card number and expiry date when you add a card (passed through our servers, not stored by us); the amount and invoice number of each charge | Uzbekistan |
| Telegram FZ-LLC | Optional: AI escalation notices to a Telegram chat the customer sets up | Workspace name, the sender's Instagram username, the message and up to three previous messages — only if the customer enables it | United Arab Emirates |
| Google LLC — Google Analytics | Website analytics, only with your consent | Pages viewed, referrer, browser and device, IP address (from which Google derives an approximate location), a cookie identifier | United States |
| YANDEX LLC — Yandex Metrica | Website analytics, only with your consent (session recording off) | Pages viewed, clicks and links followed, referrer, browser and device, IP address, a cookie identifier | Russia |
| Google LLC — Google Fonts | Fonts on the website and in the console | IP address and browser information, when the font files are requested | United States |
Instagram data reaches us from Meta Platforms, through the Instagram API, when a Customer connects an account. Meta is the source of that data, not our subprocessor; replies and posts sent from Gramdesk are delivered by Instagram under Meta's terms.
We announce a new subprocessor of End-user data on this page, and in the change log, at least 30 days before it starts processing that data, except where a change is needed urgently to keep the Service running or secure, in which case we announce it as soon as we can. Customers may object as the DPA describes.
Questions about this list: support@gramdesk.io.