| 1 | These are the companies that process information for g1t on our behalf, what each does, and what it receives. Each is bound by a contract that limits it to doing that. **We'll update this page before we add a new subprocessor**, and list the change in the [policies' history](/policies). |
| 2 | |
| 3 | ## Subprocessors |
| 4 | |
| 5 | | Company | What they do for g1t | What they receive | Where | |
| 6 | | --- | --- | --- | --- | |
| 7 | | **Cloudflare, Inc.** | Hosting and the network g1t runs on (Workers), databases (D1), storage for repositories, avatars and screenshots (Artifacts, KV and R2), queues, the sandboxes checks, workflows and builds run in (Containers), sending email (Email Service), search embeddings (Workers AI and Vectorize), and screenshots of deployed apps (Browser Rendering) | Everything stored on g1t, and every request to it | Global | |
| 8 | | **Stripe, Inc.** | Payments, cards, invoices and receipts, and working out sales tax and VAT (Stripe Tax) | Workspace owners' billing details, billing address and tax ID, card details (entered on Stripe's page, never on g1t), and what each invoice charges | United States | |
| 9 | | **650 Industries, Inc. (Expo)** | Delivering notifications to the g1t phone app, through Apple's and Google's push services | The phone's push token, and each notification's title, text and where it opens in the app | United States | |
| 10 | | **Google LLC** | Google Workspace: the mailboxes that receive email sent to us | What you write to us, and your email address | United States | |
| 11 | | **HeyCatch, Inc.** | Product analytics on g1t.sh: page views and clicks. Visitors in the EU, EEA, UK and Switzerland are asked first | The page's address (names replaced outside the public pages), the text of what is clicked on the public pages, browser and device type, IP address, the referring site, an analytics id, and a signed-in person's internal account id. Never repository content, chat, page titles inside the app, what you type, or recordings of your session | United States | |
| 12 | |
| 13 | **HeyCatch** stores analytics events with PostHog (United States) and lists its own subprocessors at [heycatch.ai/subprocessors](https://heycatch.ai/subprocessors). Its [data processing addendum](https://heycatch.ai/dpa) covers what it does for g1t, including the EU Standard Contractual Clauses for transfers to the United States. |
| 14 | |
| 15 | ## Other services g1t calls |
| 16 | |
| 17 | - **OSV.dev**, run by Google: the names and versions of packages in your lockfiles, to look up known vulnerabilities. Nothing that identifies you or your repository. |
| 18 | - **Your browser's push service** (run by its maker), when you turn on notifications in a browser: each notification, encrypted so that only your browser can read it. |
| 19 | |
| 20 | ## Services you choose |
| 21 | |
| 22 | When you connect these, your information goes to them because you asked, under your own agreement with them. They are not g1t's subprocessors: |
| 23 | |
| 24 | - **Integrations**, such as your workspace's AI provider, GitHub, Linear, Jira, Sentry and Datadog. |
| 25 | - **Webhooks** you add, which send events to the addresses you choose. |
| 26 | - **Hosts your sandboxes reach**, such as package registries and anything your jobs and builds fetch from or send to. |
| 27 | - **Custom domains** you point at your deployments. |
| 28 | |
| 29 | Questions about subprocessors: [hey@flagon.io](mailto:hey@flagon.io). |