Subprocessors
This page lists the current subprocessors and third-party providers that Maven Labs uses to operate the Decky AI add-in and its backend services. It is updated on an ongoing basis whenever a provider is added, changed, or removed, and is the authoritative, up-to-date source — supplementing the details in our Privacy Policy.
Last updated: 2026-07-21
AI model providers
| Provider | Location / Region | Data processed | Purpose | GDPR safeguard |
|---|---|---|---|---|
| Amazon Web Services – Bedrock (Enterprise plan) | EU | Inputs, conversation history | LLM inference with EU data residency | DPA, EU data processing |
| Microsoft (Azure OpenAI Service) | EU | Icon search queries, image generation prompts | Embeddings for semantic search; AI image generation — not used for chat/LLM inference on presentation content | DPA, EU data processing |
| Anthropic (Standard/B2C plan) | USA | Inputs, conversation history, search queries | LLM inference | Zero Data Retention for all plans (inputs are only technically cached for ~5 minutes to 1 hour to speed up responses, then discarded — not used for training); Data Processing Addendum, Standard Contractual Clauses (SCCs); EU-US Data Privacy Framework where currently certified (check dataprivacyframework.gov) |
Internet research
| Provider | Location / Region | Data processed | Purpose | GDPR safeguard |
|---|---|---|---|---|
| Linkup | France (EU) | Search queries (standard and deep/agentic research) | Web search and in-depth research | DPA, EU data processing (web index, query processing, and hosting all within the EU) |
Image & media providers
| Provider | Location / Region | Data processed | Purpose | GDPR safeguard |
|---|---|---|---|---|
| Unsplash | USA / Canada | Search queries | Stock photo search for slides | Standard Contractual Clauses (SCCs) |
| Pixabay | Germany | Search queries | Stock photo & illustration search | DPA (processing in the EU) |
Authentication, payment & infrastructure
| Provider | Location / Region | Data processed | Purpose | GDPR safeguard |
|---|---|---|---|---|
| Microsoft (Entra External ID) | EU | Email, profile, OpenID claims | User authentication | DPA, EU data processing |
| Stripe | USA / EU (Ireland) | User ID (metadata), subscription/payment information | Payment processing and subscription management | Standard Contractual Clauses (SCCs); EU-US Data Privacy Framework where currently certified (check dataprivacyframework.gov); PCI-DSS certification |
| Microsoft Azure (cloud infrastructure) | EU | Application data, telemetry, logs | Hosting, monitoring, error analysis | DPA, EU data processing |
| Google Workspace (Google Ireland Ltd.) | EU / USA | Support and communication data, including email correspondence | Customer support and business communication | Data Processing Addendum, Standard Contractual Clauses (SCCs) |
Analytics & tracing
| Provider | Location / Region | Data processed | Purpose | GDPR safeguard |
|---|---|---|---|---|
| LangSmith (LangChain) | EU region (EU data residency) | Truncated LLM interaction data and feedback in the Standard/B2C plan | Quality assurance, user feedback | DPA / Standard Contractual Clauses (SCCs), EU data residency; 14-day retention, on by default with opt-out in add-in settings; technically disabled and unavailable for Enterprise customers |
| PostHog | EU | Pseudonymous usage and click events; optional prompt preview truncated to 200 characters; no slide/OOXML content | Product analytics and product improvement | DPA, EU data processing; on by default with opt-out in add-in settings; technically disabled and unavailable for Enterprise customers |
For more information on the legal basis, retention periods, and your rights, see our Privacy Policy .