# Subprocessors

> **Draft — not yet reviewed by counsel.** Published for review; not in effect.

**Last updated:** 

This page lists the companies that process personal information on Manolab's behalf for Streamliner, what each does, and where. It is part of our [Privacy Policy](/privacy) and of the data processing agreement we sign with organizations.

**Free use on your own device** keeps your work off our servers, so it involves no subprocessor except when you use something we serve: Cloudflare, when you open a shared link or a sign-in page on streamliner.work, and Cloudflare and GitHub, when you send us an issue report. The AI provider you use there is yours, under your own agreement with it.

## Subprocessors we engage

### Cloudflare, Inc.

- **What it does:** runs the hosted service: the model relay, sign-in and sessions, configuration hosting, the chat record, file uploads, usage records and the activity log (Cloudflare Workers, R2 storage and Durable Objects); sends sign-in codes by email (Cloudflare Email Service); hosts this website, shared-link pages and the sign-in return page, for anyone who opens them; runs the issue-reporting service; and runs the Turnstile check that protects the report form.
- **Data:** everything held for organization accounts, as the [Privacy Policy](/privacy) describes, encrypted per account with keys we control (except streamlines shared by link, which are public by design, and issue-report screenshots); email addresses and codes for sign-in mail; the technical information of web requests.
- **Where:** Cloudflare's global network; stored data in the storage locations Cloudflare chooses [Nima and counsel: confirm, and decide whether to set a jurisdiction such as the US or EU for storage].
- **Its terms:** [cloudflare.com/privacypolicy](https://www.cloudflare.com/privacypolicy/)

### GitHub, Inc. (Microsoft)

- **What it does:** holds the private issue tracker that issue reports are filed into.
- **Data:** what a person puts in an issue report (a title, a description, an optional name and email, a link to any screenshot), the app version and build, platform and system version, device model, language and region, and the reference of the chat that was open (never its content).
- **Where:** United States. [Counsel: confirm GitHub's Data Privacy Framework certification before citing it for transfers.]
- **Its terms:** [GitHub's privacy statement](https://docs.github.com/site-policy/privacy-policies/github-general-privacy-statement)

## The AI provider an organization chooses

### Anthropic, PBC: at the organization's election, under the organization's own agreement with it

- **What it does:** runs the AI model that answers in an organization's streamlines. It is today's only supported provider.
- **How it is engaged:** the organization chooses the provider and supplies **its own key**, under **its own agreement with the provider**. Our relay sends the organization's requests to the provider, with that key, on the organization's instruction. The provider's terms with the organization, not a contract between Manolab and the provider, govern the provider's processing.
- **Data:** what is sent to the model for each request: the person's messages, the conversation so far, tool results, attached files, scanned codes and the streamline's instructions; never values entered in secure forms.
- **Where, and for how long:** under the organization's agreement with Anthropic. See [anthropic.com/legal](https://www.anthropic.com/legal).
- **One exception:** when an owner or admin uses the Concierge to change the organization's setup, the request goes from their device to the provider with **their own key**, not through our relay.

## Services people use alongside Streamliner

These aren't our subprocessors, because they act for the person or organization directly, but they are part of the picture:

- **Apple**: Sign in with Apple (for members who choose it), the App Store, iCloud (for people who turn on sync on their own devices), the speech recognition that runs on the device, and crash reports Apple shares with developers when a person allows it.
- **The servers and APIs a streamline connects to**, which the organization (or the person, on their own device) chooses, and which the app calls directly.

## Changes

When we add or replace a subprocessor, we update this page and give organizations that have a data processing agreement with us notice in advance, as that agreement provides, so they can object. [Counsel: confirm the notice period and mechanism, typically 30 days, by email to owners.]

**Manolab, LLC**