Subprocessors and Data Recipients
Last updated November 6, 2026
Effective September 24, 2026
Contents7 sectionsHide
How to read this registry
A subprocessor processes Customer Personal Data for Foundable to deliver the Service. The table states the production path that uses each provider; an entry does not mean every customer uses every provider. Providers used only for Foundable's own operations, and third parties that determine their own purposes, are described separately after the table.
The location column identifies verified project regions or the provider's published processing footprint. It is not a promise that support, security, or subprocessor access can occur in only one country. Contact us if your procurement process requires the account-specific contracting entity, data-residency configuration, or transfer mechanism.
Customer-data subprocessors
| Provider | Scope and purpose | Data processed | Primary storage / processing locations |
|---|---|---|---|
| OpenAI | Core AI: The models behind Ted's conversation, idea-first onboarding, setup research and business ideas, chat titles, the embeddings that let Ted recall older chats, and the AI features of websites built with Foundable, their pictures included | Customer Content in a chat or call: messages, attached context, retrieved history, tool inputs and outputs, and the text embedded for recall; for setup research, a new owner's name and email and what research finds about them; for a website's AI features, what its visitors send them (their words and any picture they ask to change), the website's own records they search by meaning, and the answers and pictures made for them | United States and other OpenAI or subprocessor locations unless a separate data-residency arrangement applies |
| Anthropic, PBC | Chat, paid runs, Ted's helpers, Build and drafting AI: Claude models for Chat, Ted's free mode, Ted's paid runs, his helpers (summaries of long chats, reading he hands off, posts, logos, brand reads and product pictures, Run's caption, picture and reply drafts, and daily updates), Build's website agents and their planning, Inbox reply drafts and the emails Ted writes or rewrites there, and the composition of videos Ted renders | Customer Content in a Chat conversation (the owner's messages and the files they send, the chat's earlier messages and summary, and what Ted knows of the business and its websites) and in a paid run (its messages, files, tool inputs and outputs, including what Ted reads from connected apps), what a helper is asked and works from (a long chat's messages and tool results; the pages, website, website data and files Ted asks it to read; the business's plan, brand, recent posts, and its website's screenshots, styles, words and pictures; a caption being rewritten, or the comment or message a reply answers; a day's sales, sign-ups, visitors and Ted's waiting and finished work), the brief, the website source and files a Build run works on, the mail a reply is drafted for, the drafts and requests behind the emails Ted writes or rewrites, and the composition a video is made from | Stored in the United States; processing may occur in the United States, Europe, Asia, and Australia unless a separate arrangement narrows it |
| fal.ai | Image and sound generation: Runs OpenAI's GPT Image model for the images Build and Ted generate, and ElevenLabs' sound effects model for the sounds Ted makes | Image and sound prompts, reference images, generated outputs, and request metadata | Provider and model infrastructure locations; no single processing region is asserted by Foundable |
| Google LLC (Google Cloud)From November 6, 2026 | Video generation: Runs Google's Gemini Omni model for the videos Ted makes | Video prompts, reference images, generated videos, and request metadata | Google Cloud's global location; no single processing region is asserted by Foundable |
| Perplexity AI, Inc. | Web search: Web search when Ted researches on your behalf, when setup research looks up a new owner, and for the AI features of websites built with Foundable | The search queries Ted derives from a conversation; for setup research, searches built from a new owner's name and email (their name, beside their email's domain when that domain is an organization's, and any others research chooses, which can include the email address); for a website's AI features, the searches it makes, which can carry what its visitors ask; and the public results returned | Provider and subprocessor locations; no single processing region is asserted by Foundable |
| Monid Inc. | Public data: Routes the public data lookups Ted runs and his business searches to the data providers it lists (social platforms, reviews, listings, markets and search rankings) and bills them, and checks through Hunter whether an address Ted may write to can receive mail | The lookup inputs Ted derives from a conversation, such as search terms, business names and public page or profile addresses, the email addresses Ted may write to, and the public data and answers returned; Monid keeps each run's input and output on Foundable's account | United States (Monid Inc., San Francisco); each provider a lookup reaches processes it in its own locations |
| TypeSafe AI, Inc. | Reasoning: Chooses how much reasoning Ted uses for each reply, and checks whether a new owner's first message gives Ted anything to work with | A chat's newest messages, a new owner's first message, and the choices it returns | United States (San Francisco) |
| Turbopuffer, Inc. | Chat recall: The search index over a foundable's older chats that Ted retrieves from | Embeddings and excerpts of a foundable's chat history with their chat and foundable identifiers | AWS us-west-2 (Turbopuffer's region for Foundable's index) |
| Mobbin | Design references: Screen references Build searches while planning a website | Search terms derived from the brief; no Customer Content beyond those terms | Provider locations under its terms |
| Judgment Labs, Inc. | AI quality analytics: Traces of Ted's model calls and of the tools he calls, for quality monitoring | Model inputs and outputs, the tools Ted calls with their inputs and results (each limited in size), token counts, and the chat and turn identifiers; the foundable and user are labelled by stable hashes, though the inputs and outputs can name them, such as a person's sign-in email in the chats they start, and a new owner's name and email and what setup research finds about them | Provider and subprocessor locations under the applicable service terms; contact Foundable for account-specific details |
| Amazon Web Services, Inc. | Core infrastructure: The API and workers on ECS Fargate, the Aurora PostgreSQL database, object storage for saved files, uploads and workspace checkpoints, secrets, and service logs, behind a CloudFront front door | Account data, Customer Content, requests in transit, runtime data needed to execute work, and application and infrastructure logs | AWS us-west-1 for the database, services and storage; CloudFront's global edge for requests in transit |
| Cloudflare, Inc. | Publishing: Serves every published website on foundable.app from its edge, stores their releases in R2, runs a website's server code in a Worker and records that code's server log, and captures the screenshots of saved versions | Published website files, a website's server code, the requests its visitors make and what the code prints, and the pages captured for thumbnails | Global network |
| Temporal Technologies, Inc. | Durable workflows: Temporal Cloud orchestrates Ted turns, Build runs, mail and social delivery and scheduled runs so interrupted work resumes | Workflow histories: the inputs and results each step records, which include Customer Content from the turn or run they belong to | Temporal Cloud; the namespace's region and retention are under Foundable's Temporal account |
| Modal Labs, Inc. | Sandboxes: Isolated sandboxes where Build authors and compiles websites, Ted's workspace runs commands, and videos are rendered | Website source and files, build instructions and output, workspace files and encrypted spare copies of them, logs, and rendered video | Modal's infrastructure in the environment Foundable configures; no single region is asserted by Foundable |
| Pierre Computer Company, Inc. | Website code: Code Storage keeps each website's source code and saved versions in a Git repository of its own; Build reads and writes it, and Git sync reads it | Website source files and their version history, including any Customer Content written into a website's files | Pierre's infrastructure in the region of Foundable's Code Storage organization; no single region is asserted by Foundable |
| Supabase, Inc. | Website backends: One hosted backend per website, created only when the website needs one: its database, storage and its visitors' sign-in | The website's data and files, and its visitors' accounts and sign-in events | AWS us-west-1 (the region Foundable creates each project in); support and subprocessor processing may occur elsewhere under Supabase's DPA |
| WorkOS, Inc. | Authentication: Sign-in with Google, Apple, or an emailed code, and the sessions that keep you signed in | Account email and name, the identity from Google or Apple, and sign-in and session events including IP address and user agent | United States and subprocessor locations under WorkOS's DPA |
| Stripe, Inc. and applicable Stripe affiliates | Billing and Foundable Payments: Checkout, subscriptions, invoices and the billing portal for Foundable plans, Checkout for credit packs, and the Stripe account a foundable uses to sell to its own customers through Foundable Payments | Billing contact and address, payment-method details entered with Stripe, invoices, subscriptions and transaction history; for Foundable Payments, the foundable's account details and its customers' purchases | Stripe and payment-network locations under the applicable agreement |
| AgentMail, Inc. | Inbox: The mailbox each foundable gets on foundable.app or its own domain, and the mail sent from it | Sender and recipient addresses, subjects, message bodies, attachments, replies, and delivery events | United States and European Union under AgentMail's current subprocessor list |
| Linq | Texting: Texting with Ted over iMessage or SMS, for signed-in accounts that link a phone | Phone numbers, message content, images sent in a text, and delivery events; a paused number's STOP or START is kept as a salted digest | United States hosting under Linq's terms |
| ZERNIO SOFTWARE SL | Social publishing, managed campaigns and phone numbers: Connecting social accounts, publishing to them from Run, and running and measuring approved campaigns | Connected-account credentials and identifiers, post and campaign copy and media, publishing status, engagement and campaign analytics; for consented visits on participating websites, website and business identifiers, event identifiers and times, visitor IP addresses and browser details | Spain / European Union and provider subprocessor locations |
| Sampark Inc (Composio) | Connected apps: Connects the apps an owner or admin links in Settings > Integrations, holds their sign-in credentials, and runs the reads Ted makes and the actions an owner or admin delegates or approves in them | Connected accounts' credentials and identifiers, the reads Ted runs and what they answer, and the actions delegated or approved in a connected app | Provider and subprocessor locations; no single processing region is asserted by Foundable |
| Intercom, Inc. and applicable Intercom affiliates | Customer support: The signed-in support Messenger, conversation history, teammate inbox, and reply notifications | A signed statement of the operator's account identifier, the support messages and attachments the operator sends, and support reports Ted sends when the operator needs help, with their latest message and its pictures | United States workspace when enabled; limited support and subprocessor processing may occur elsewhere under Intercom's DPA |
| Mailgun Technologies, Inc. (Sinch) | Email delivery: Foundable's emails to you (such as sign-in codes, team invitations, plan notices, milestones, the notes and answers Ted writes you, and reply notifications), the emails websites built with Foundable send, the newsletters Ted sends for them, their visitors' sign-up emails, and your replies to Ted's emails, which it passes to Foundable | Recipient and sender addresses, message content, and delivery metadata | United States (Mailgun's US region) and subprocessor locations under Sinch's data processing agreement |
| PostHog, Inc. | Product analytics: Product analytics and session recordings from the workbench and the public pages | Page views, clicks and usage events with timing, session recordings of the screens viewed, websites and documents included, with typed field values masked and passwords, sign-in codes and secret-entry fields excluded, a device identifier and campaign tags, and for a signed-in person their account identifier, email and name | PostHog Cloud in the region Foundable's project is created in (United States or European Union) |
| Functional Software, Inc. (Sentry) | Error monitoring: Error reports from the browser and the servers | Error messages, stack traces, the release and a request identifier; headers, bodies, credentials and personal fields are removed before an event leaves, and no session is replayed | Sentry's ingestion region for Foundable's project |
AI-provider data handling
OpenAI's models are the primary model family for Ted's conversation and for idea-first onboarding, except in Chat, Ted's free mode; Anthropic's Claude models power Chat, Ted's paid runs and his helpers, Build's website agents, Inbox drafts and video composition. fal.ai receives prompts and reference images only when an image or sound is generated, Perplexity receives queries only when Ted or a website's AI features search the web, and Monid receives a lookup's inputs only when Ted looks up public data, searches for businesses or checks an address he may write to. Each provider is limited to the feature scope and data categories listed in the table.
- OpenAI states that business/API data is not used to train models by default. Its endpoint-specific retention and abuse-monitoring rules are described in its data-control documentation.
- Anthropic's commercial terms prohibit training on Customer Content submitted through its services. Its standard API retention is generally up to 30 days, with longer trust-and-safety or legal retention in documented cases. See its current retention documentation.
- Judgment Labs receives the agent traces described in the table for quality monitoring: model inputs and outputs, and the tools Ted calls with their inputs and results, each limited in size, with the foundable and user labelled by stable hashes, though those inputs and results can name them, as the table says. Contact Foundable with account-specific contractual or data-handling requirements.
Operational service providers
These vendors support Foundable's controller-side operations. They are not included in DPA Annex III when they do not process Customer Personal Data on a customer's behalf:
- GitHub: Foundable's source code. Customer-report metadata may appear when employees handle an issue, but product Customer Content is not intentionally stored there.
Recipients acting under their own terms
Some features send data to a recipient that acts as an independent or joint controller, or has a role that varies by activity. Those recipients are not blanket Foundable subprocessors for that activity:
- Connected integrations and social networks receive the data and actions you direct Foundable to send. Their own terms govern their use of it.
- Meta receives approved campaigns and the limited events described in Sections 7 and 8 of our Privacy Policy, for measurement and personalized promotions under its Business Tools Terms.
- OpenAI receives the limited events described in Section 8 of our Privacy Policy, to measure Foundable’s own ads in ChatGPT.
- Google signs the visitors of a published website in when the website offers Google sign-in, under Google's own terms; the visitor's account then lives in the website's backend.
- GitHub receives a new owner's verified email and name when setup research searches its public commits and profiles, under GitHub's own terms.
- Stripe processes billing operations for Foundable and determines its own purposes for payment-network, fraud, compliance and tax activities, both for your Foundable purchases and for the Stripe account a foundable uses to sell through Foundable Payments.
Changes and objections
We update this registry when a provider or its role changes, and post a new provider here, with the date, at least 15 days before it receives customer personal data.
To ask about a provider, request account-specific processing details, or raise a data-protection objection, email privacy@foundable.com. Section 7 of our Data Processing Addendum sets out how to object.
Contract status
Our Data Processing Addendum forms part of our Terms for every account, so its transfer safeguards, audit rights and notice periods apply without a separate agreement.