Legal
Subprocessors
Companies that process customer personal data for Screwtape.ai. Last updated 2026-10-24. Machine-readable copy: /subprocessors.json.
| Subprocessor | Purpose | Data | Location | Safeguard |
|---|---|---|---|---|
| Cloudflare, Inc. | Hosting (Workers), database (D1), CDN, DNS and the Workers AI fallback model | All API traffic in transit, D1 rows (keys as hashes, receipts, opt-in retained content), and judged content sent to the Workers AI fallback | United States and Cloudflare's global network | Cloudflare DPA with EU Standard Contractual Clauses (Modules 2 and 3) and EU-U.S. Data Privacy Framework certification |
| Groq, Inc. | Model inference for judge and consensus calls (default model openai/gpt-oss-120b) | Judged content (task, agent output, evidence) for each call | United States | Groq Customer Data Processing Addendum with EU Standard Contractual Clauses |
| PayPal | Card and PayPal payments for packs and plans (PayPal acts as an independent controller for payment data) | Payer name, email, amount and order id. No judged content | United States and PayPal's regions | PayPal's own privacy statement and transfer safeguards |
| x402 facilitators (x402.dexter.cash, facilitator.xpay.sh) | Verify and settle USDC payments; they receive the payment payload only, never judged content | Signed payment payload and public wallet address | Operator-hosted, location not published | No personal data beyond a public wallet address is sent |
| Public blockchain RPC providers (Base, Solana) | Read on-chain payment status | Public transaction hashes and wallet addresses | Various | Only public transaction data is read |
| Google LLC (Gmail) | Support and contact inbox (screwtapedev@gmail.com; security@screwtape.ai forwards to it) | Whatever you choose to email us: name, email address and message content | United States and Google's global network | Google Workspace and Cloud data processing terms with EU Standard Contractual Clauses and EU-U.S. Data Privacy Framework certification |
| Kit, Inc. (kit.com) | Newsletter sign-ups (the newsletter form at screwtape-ai.kit.com) | Subscriber email address. Not API customer data: no keys, judged content or receipts | United States | Kit Data Processing Addendum with EU Standard Contractual Clauses and UK IDTA, and EU-U.S. Data Privacy Framework certification |
Not subprocessors
GitHub hosts our source code and receives no customer data.
Changes
- 2026-10-24: Correction: Kit, Inc. added. It already held newsletter subscriber emails, and this page wrongly said we use no email marketing service. No new processing started.
- 2026-10-24: Correction: Google LLC (Gmail) added. It already hosted our support inbox and was missing from this list. No new processing started.
We announce new subprocessors here at least 14 days before they process customer personal data. Questions: screwtapedev@gmail.com. See also the privacy notice, the DPA and the trust page.