This page identifies the service providers and other recipients to which Auffy discloses personal data, so you can see who is involved before you upload anything. It forms part of our Privacy Policy.
1. The companies we use
| Company | What it does for us | Personal data involved | Where |
|---|---|---|---|
| UPBIT WEB DESIGN SRL (Romania) | Hosts the application, the database, your uploaded files and our outgoing account email | Account, content, uploaded-file, usage and technical data | Servers in Germany |
| OpenRouter, Inc. (United States) | Routes our AI requests to the model that answers them | Content and files sent for AI processing, the responses, and request metadata | United States |
| Jingsheng Hengxing Technology Pte. Ltd., trading as Z.AI (Singapore) | Runs the language model that drafts your answers and reads your uploaded documents | Content and files sent for AI processing, the responses, and request metadata | Singapore |
| Stripe Payments Europe, Limited (Ireland), with Stripe Technology Europe, Limited as the regulated payment institution | Payments, invoices, tax calculation and the billing portal | Account and billing data, and payment-method information Stripe collects directly | Ireland |
| Google Ireland Limited | “Sign in with Google”, if you choose it | Google account and authentication data | Ireland |
| Usercentrics A/S, trading as Cookiebot (Denmark) | The cookie consent banner on the public website | Consent choices and technical request data, including IP address | Denmark |
Auffy does not send your Projects or your forms to Stripe or to Google. Stripe acts as our processor for parts of its service and as a controller in its own right for payment, fraud-prevention and legal-compliance purposes; Google is a controller in its own right for the Google account you sign in with. Their own privacy notices apply to that processing as well as ours. The other companies act on our instructions, under the data processing terms we have agreed with each of them.
The companies above use onward providers of their own for things such as cloud hosting, storage, security and monitoring. Those providers form part of that company's own processing chain, under its own agreements, and are not listed here. A company that runs the model we ask for is listed in the table above, not treated as somebody else's supplier.
Our fonts are served from our own servers, so loading a page does not contact a font provider. The consent banner and its cookie declaration are the only scripts on the public pages supplied by anyone else; they come from Usercentrics, which is listed above.
2. How the AI companies may use your content
To draft an answer or read a document, Auffy sends the relevant content to whichever of the AI companies above handles that request. We require them to process it only in order to provide and secure the service, and not to use it to train models. We do not train models on your content either.
What each of them keeps, and for how long, is governed by its own terms: at the time of writing Z.AI states that API content is processed in real time and not stored, while OpenRouter retains what it needs for security, billing and legal compliance.
3. Sending data outside the EEA
Our hosting, payment and sign-in providers are all inside the European Economic Area. The AI companies are not. Neither the United States nor Singapore is covered by a European Commission adequacy decision that applies to these transfers, so for both we rely on the European Commission's Standard Contractual Clauses.
You may ask for a copy of the safeguards that apply to a particular transfer by writing to [email protected]. We may redact commercially confidential terms before sending them, and we will say what we have removed.
4. When this list changes
We update this page when a company is added or removed, and when what it does for us or the country it is in changes, and we change the date at the top. We update it before a new company begins processing your personal data.
Changing the model we ask for inside a company already listed does not change who receives your data. Sending your data to a different company does, and that company is added to the table.
5. Questions
Write to [email protected]. You are entitled to ask which recipients have actually received personal data about you, and we will tell you.