Legal
Subprocessors
The third-party providers that process personal data for Pinevon services, and what each one does.
Version 0.2-draft · No effective date set yet · All legal documents
Draft — pending legal review. This document is a complete working draft prepared by the Pinevon team. It has not yet been reviewed by a lawyer and no effective date has been set. It describes how the service is actually built and operated today; bracket-free wording is deliberate, but jurisdiction-specific terms must be confirmed by qualified counsel before it is relied on.
Current subprocessors
Pinevon uses the providers below to run the Services. “Configured” means in use; “Optional” means used only when the feature or fallback is enabled. We add or replace subprocessors only after a data-protection review and with notice as described in the DPA.
| Provider | Purpose | Data involved | Status |
|---|---|---|---|
| Supabase | Identity, database and file storage | Account, profile, product data, files | Configured |
| Vercel | Website and web-app hosting, edge delivery | Requests, IP addresses, logs | Configured |
| Render | Anchor backend API hosting | Product API traffic and data in transit | Configured |
| Resend | Transactional and support email delivery | Recipient email, message content | Configured |
| Google (Gemini API) | AI-generated replies | Conversation content sent for a reply | Configured |
| Groq | AI-generated replies (fallback) | Conversation content sent for a reply | Optional |
| OpenAI | AI-generated replies (fallback) | Conversation content sent for a reply | Optional |
| Anthropic | AI-generated replies (fallback) | Conversation content sent for a reply | Optional |
| FastSpring / Paddle / Stripe (as enabled) | Payment processing and tax as merchant of record or processor | Billing contact, plan, payment status | Optional — enabled per product when production approval is complete |
| Meta (WhatsApp / Messenger) | Customer messaging channels the business connects | Message content and identifiers for connected channels | Optional — only when a business connects a channel |
Changes and notice
To be told before a change, email privacy@pinevon.com with the subject “Subprocessor notices”. Customers with a DPA are notified at least 14 days before a new subprocessor starts processing their data.