Sub-processors

This page lists the third-party service providers ("sub-processors") that process data on our behalf in operating MinuteKeep (the "Service"), what each receives, and where each processes it. It forms part of, and is incorporated into, our Privacy Policy.

1. Core Infrastructure

Provider	Function	Data received	Location
Render Services, Inc. Privacy policy	Application hosting and managed PostgreSQL database	All account data and Corporate Data, including directors', officers', and shareholders' names and residential addresses; all traffic passes through and is stored on this infrastructure	United States (Oregon)
Cloudflare, Inc. (R2) Privacy policy	Object storage for generated documents and uploaded files	Generated PDFs and Word documents, uploaded files — which contain the full contents of your corporate records	Globally distributed; primarily United States

2. Payments

Provider	Function	Data received	Location
Stripe, Inc. Privacy policy	Payment processing, subscription billing, invoicing, and customer billing portal	Name, email address, payment card details (collected directly by Stripe — never transmitted to or stored on our servers), billing address, transaction and subscription records, device and fraud-signal data	United States

3. Communications

Provider	Function	Data received	Location
Resend, Inc. Privacy policy	Transactional and product email delivery	Recipient name and email address, message subject and body, delivery metadata; messages may include document links and corporation names	United States
Slack Technologies (Salesforce, Inc.) Privacy policy	Internal operational alerting to our own workspace	Short operational alert messages, which may include an account email address, corporation name, or error summary	United States

4. Authentication

Provider	Function	Data received	Location
Google LLC Privacy policy	Google single sign-on (only if you choose it)	Authentication request metadata; we receive your name, email address, and account identifier. We never receive your password	United States
Microsoft Corporation Privacy statement	Microsoft single sign-on (only if you choose it)	Authentication request metadata; we receive your name, email address, and account identifier. We never receive your password	United States

5. Artificial Intelligence

Provider	Function	Data received	Location
Anthropic PBC Privacy policy	Large language model powering the setup assistant, in-application assistant, resolution assistant, internal bug-report triage, and AI organization of PDFs, which owners of Pro corporations may turn on	Text you type into an assistant and recent conversation history; for bug reports, your description, email address, and page context; for AI organization, one selected or phone-scanned PDF of up to 10 MiB and 50 pages, but only after an eligible owner explicitly confirms the action	United States entity; processing may occur outside Canada and no particular processing location is guaranteed
OpenAI, L.L.C. Privacy policy	Fallback large language model for assistant features, where configured; not used for AI-assisted PDF organization	Assistant text and recent conversation history; bug-report information where that assistant fallback is used	United States

For AI organization, MinuteKeep uses Anthropic's commercial API, submits the selected PDF only to obtain the requested suggestion, and does not opt the feature into provider model training or improvement. Anthropic states that commercial API inputs and outputs are not used to train its models by default unless the customer opts in. Its published standard API retention is up to 30 days, subject to documented exceptions for services with longer retention, a different agreement, Usage Policy enforcement, or law. MinuteKeep has verified that its Anthropic organization and runtime configuration have no training opt-in, and publishes the current terms, retention, and processing-region facts here. See Anthropic's published commercial training policy and commercial retention policy, our Data Processing Terms, and the AI Disclosure & Disclaimer.

6. Monitoring, Analytics, and Marketing

Provider	Function	Data received	Location
Functional Software, Inc. (Sentry) Privacy policy	Error and exception monitoring	Error messages, stack traces, and runtime context. Configured not to transmit request bodies, cookies, or headers	United States
Google LLC (Google Analytics 4) Privacy policy	Website and application usage analytics	IP address, device and browser data, pages and events, referral source, and an analytics identifier	United States
Google LLC (Google Ads) Privacy policy	Advertising conversion measurement: when you arrive from a Google ad, the Google click identifier (gclid/gbraid/wbraid) is stored and signup and purchase conversions are reported to Google Ads, including server-side	Google click identifier, conversion event type, timestamp, and value; no name or email address is included	United States
Microsoft Corporation (Clarity) Privacy statement	Session replay and heatmaps	A reconstruction of your session — interactions, navigation, and page structure. Form-field text is masked by default configuration, but we do not warrant that every field is masked in every circumstance	United States
Meta Platforms, Inc. Privacy policy	Advertising measurement, conversion tracking, and audience building	IP address, browser and device data, page views, and conversion events such as signup and purchase	United States
Refgrow Website	Affiliate referral attribution and commission tracking	Referral code, signup and purchase events, and the email address associated with an attributed signup	Outside Canada

7. Government and Public Registries

Body	Function	Data sent	Location
Innovation, Science and Economic Development Canada	Federal corporate registry lookup, at your request	Only the corporation number or name you are searching. No account or Corporate Data is sent	Canada

Registry data is returned by the registry, may be incomplete or out of date, is not verified by us, and is provided as a convenience only.

8. Content Delivery

The Service loads scripts from third-party content delivery networks, including Stripe's JavaScript library and the script hosts for the analytics and advertising tools above. These providers receive your IP address and browser information as a necessary consequence of serving the resource. Traffic may be routed through, and cached at, edge locations in any country.

9. Changes to This List

We may add, remove, or replace sub-processors at any time, without notice to you. This page is maintained to reflect current arrangements, and updates to it take effect on posting. We do not operate a sub-processor objection or approval process. Continued use of the Service constitutes acceptance of the current list.

This list is provided in good faith and for transparency. It is a description of current arrangements, not a warranty, and it does not create any commitment as to any provider, region, safeguard, or configuration.

Questions: support@minutekeep.ca.