Subprocessors
This page lists the current subprocessors and third-party providers that Maven Labs uses to operate the Decky AI add-in and its backend services. It is updated on an ongoing basis whenever a provider is added, changed, or removed, and is the authoritative, up-to-date source — supplementing the details in our Privacy Policy.
AI model providers
| Provider | Location / Region | Data processed | Purpose | GDPR safeguard |
|---|---|---|---|---|
| OpenRouter, Inc. – EU in-region endpoint (Enterprise plan) | EU | Inputs, conversation history | LLM inference with EU data residency; the models run on Amazon Bedrock (AWS, Ireland region) and Google Vertex AI (EU region) as sub-processors of OpenRouter | DPA, EU data processing (inputs and outputs are processed within the EU and do not leave it); Zero Data Retention enforced on every request (routing only to model providers with Zero Data Retention that do not use data for training), OpenRouter does not persistently store request content; Standard Contractual Clauses (SCCs) for the US company. OpenRouter is not certified under the EU-US Data Privacy Framework (verified against the official list at dataprivacyframework.gov on 2026-09-17). |
| Microsoft (Azure OpenAI Service) | EU | Icon search queries, image generation prompts | Embeddings for semantic search; AI image generation — not used for chat/LLM inference on presentation content | DPA, EU data processing |
| OpenRouter, Inc. – global endpoint (Standard/B2C plan) | USA / EU | Inputs, conversation history, search queries | LLM inference; the models run on Amazon Bedrock (AWS) and Google Vertex AI in the EU or the US as sub-processors of OpenRouter | Zero Data Retention enforced on every request (routing only to model providers with Zero Data Retention; inputs are only technically cached for a few minutes up to 1 hour to speed up responses, then discarded — not used for training); OpenRouter does not persistently store request content; Data Processing Agreement, Standard Contractual Clauses (SCCs). OpenRouter is not certified under the EU-US Data Privacy Framework (verified against the official list at dataprivacyframework.gov on 2026-09-17); the transfer safeguard relied upon is SCC + DPA, not an adequacy decision. |
Internet research
| Provider | Location / Region | Data processed | Purpose | GDPR safeguard |
|---|---|---|---|---|
| Linkup | France (EU) | Search queries (standard and deep/agentic research) | Web search and in-depth research | DPA, EU data processing (web index, query processing, and hosting all within the EU) |
Image & media providers
| Provider | Location / Region | Data processed | Purpose | GDPR safeguard |
|---|---|---|---|---|
| Unsplash | USA / Canada | Search queries | Stock photo search for slides | Standard Contractual Clauses (SCCs) |
| Pixabay | Germany | Search queries | Stock photo & illustration search | DPA (processing in the EU) |
| Logo.dev (Simple Casual, LLC) | USA | Company domains only (requested server-side; no personal data, no user IP addresses) | Company logo lookup for slides | DPA; no transfer of personal data |
Authentication, payment & infrastructure
| Provider | Location / Region | Data processed | Purpose | GDPR safeguard |
|---|---|---|---|---|
| Microsoft (Entra External ID) | EU | Email, profile, OpenID claims | User authentication | DPA, EU data processing |
| Stripe | USA / EU (Ireland) | User ID (metadata), subscription/payment information | Payment processing and subscription management | Standard Contractual Clauses (SCCs); EU-US Data Privacy Framework (verified as active on the official list at dataprivacyframework.gov on 2026-07-21); PCI-DSS certification |
| Customer.io, Inc. | EU (Belgium data center) | User ID, email, name, plan, usage-related events | Customer communication (service emails) | DPA, EU data center; EU-US Data Privacy Framework and Standard Contractual Clauses (SCCs) for the US company |
| Microsoft Azure (cloud infrastructure) | EU | Application data, telemetry, logs | Hosting, monitoring, error analysis | DPA, EU data processing |
| Google Workspace (Google Ireland Ltd.) | EU / USA | Support and communication data, including email correspondence | Customer support and business communication | Data Processing Addendum, Standard Contractual Clauses (SCCs) |
Analytics & tracing
| Provider | Location / Region | Data processed | Purpose | GDPR safeguard |
|---|---|---|---|---|
| LangSmith (LangChain) | EU region (EU data residency) | Truncated LLM interaction data and feedback in the Standard/B2C plan | Quality assurance, user feedback | DPA / Standard Contractual Clauses (SCCs), EU data residency; 14-day retention, on by default with opt-out in add-in settings; technically disabled and unavailable for Enterprise customers |
| PostHog | EU | Pseudonymous usage and click events; optional prompt preview truncated to 200 characters; no slide/OOXML content | Product analytics and product improvement | DPA, EU data processing; on by default with opt-out in add-in settings; technically disabled and unavailable for Enterprise customers |
For more information on the legal basis, retention periods, and your rights, see our Privacy Policy.