Sub-processors
Effective May 18, 2026.
We rely on the following third parties to operate ReplyBird. Each receives only the data necessary for its role. We will give 30 days' notice on this page before adding a new sub-processor that processes personal data.
| Sub-processor | Role | Data processed | Location |
|---|---|---|---|
| Anthropic | Language model provider (Claude) | Email subject + body, voice-profile metadata, and prompts at request time. Anthropic retains inputs and outputs for a maximum of 30 days for trust-and-safety review under its zero-retention API policy commitments. | United States |
| Voyage AI | Embedding model provider | Sentences and short passages extracted from your sent emails for similarity search. | United States |
| Google LLC | Gmail OAuth + Calendar + Pub/Sub | OAuth tokens for your Gmail account; the inbox and sent folder content we read on your behalf; calendar free/busy data when you have enabled instant responder calendar suggestions. | Global (varies by data center) |
| Clerk Inc. | Authentication | Email address, hashed password (if any), session tokens, sign-in history. | United States |
| Polar (Polar Software Inc.) | Payments, Merchant of Record | Billing email, country, subscription status, payment method tokens (we never see card numbers). | United States |
| Vercel Inc. | Web application hosting and CDN | Request logs (IP, user agent, paths), server-rendered content, and edge cache. | United States + global edge |
| Railway Corporation | Postgres database + Inngest queue + Redis | All persistent application data, including cached email content (encrypted at rest), voice profiles, embeddings, and operational queue state. | United States |
Sub-processor notice
Customers under a Data Processing Addendum (DPA) who wish to receive direct notification of new sub-processors should email legal@replybird.app with their account email so we can add them to the notification list.