Sub-processors

Last updated: October 2026

Every service that receives personal data from Nolario, with purpose, data, location and retention. The full policy is the privacy policy.

Vercel

Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA

Hosting of website and app, server functions, scheduled jobs, server logs; cookieless reach measurement (Vercel Web Analytics)

Data: Every request (IP address, browser, page); all data the app processes passes through its servers; error logs
Where: USA
Kept by provider: Logs per Vercel's plan limits (days, not months); processed data is not stored by Vercel beyond the request
Used: Always

Google Firebase (Authentication, Cloud Firestore)

Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, USA

Sign-in (email/password, Google, Microsoft) and the database that holds your account and everything Nolario stores for you

Data: Email address, name, sign-in data; access keys of connected accounts; message previews, summaries, drafts, chats, your memory; waitlist entries
Where: USA (Firestore region nam5)
Kept by provider: Until you or we delete it (see storage periods)
Used: Always

OpenAI

OpenAI, L.L.C., 1455 3rd Street, San Francisco, CA 94158, USA (for EEA customers: OpenAI Ireland Ltd., Dublin)

Main AI provider: ranking, summaries, drafts, chat, memory, search index (embeddings), speech to text, read-aloud, voice assistant, images

Data: Mail content after the filter chain (names replaced by roles, secrets removed, amounts and dates rounded); your own chat input through the same filter; unfiltered: attached images, your voice as audio, text read aloud
Where: USA (no EU endpoint)
Kept by provider: Per OpenAI up to 30 days for abuse monitoring, then deleted; requests are sent with store:false; no zero data retention agreement
Used: Whenever you use an AI feature

Anthropic

Anthropic PBC, 548 Market Street, San Francisco, CA 94104, USA

Second AI provider for writing tasks (drafts, chat); used instead of OpenAI for some tasks when configured

Data: Mail content after the filter chain; your own chat words
Where: USA (no EU endpoint)
Kept by provider: Per Anthropic up to 30 days, then deleted; no zero data retention agreement
Used: When you use an AI feature routed to it

Google Gemini API

Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA

Importance scoring of new messages; optional chat model

Data: Sender and subject after the filter chain; for chat, as with OpenAI
Where: USA
Kept by provider: Per Google, kept for a limited period for abuse monitoring (paid API: up to 55 days); not used to improve Google's products on the paid API
Used: When scoring runs or you pick a Gemini model

Mistral AI

Mistral AI SAS, 15 rue des Halles, 75001 Paris, France

Optional chat model you can pick

Data: Your chat request; context from your inbox after the filter chain
Where: EU
Kept by provider: Per Mistral up to 30 days
Used: Only if you pick a Mistral model

Groq

Groq, Inc., 400 Castro Street, Mountain View, CA 94041, USA

Optional fast chat model you can pick

Data: Your chat request; context from your inbox after the filter chain
Where: USA
Kept by provider: Per Groq's API terms
Used: Only if you pick a Groq model

Cloudflare (R2, Turnstile)

Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA

Storage of files you upload (R2); bot check on the waitlist form (Turnstile)

Data: Your uploaded files and profile picture; for the bot check, IP address and browser signals
Where: Cloudflare network (bucket location set by us)
Kept by provider: Files until you delete them or your data; bot check not stored by us
Used: When you upload a file or join the waitlist

Stripe

Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland

Payment, subscriptions, invoices, tax calculation

Data: Email address, your Nolario user ID, plan; Stripe itself collects card and billing address. We never see your card number
Where: EU and USA
Kept by provider: Per Stripe, as long as tax and anti-money-laundering law requires
Used: When you subscribe

Resend

Plus Five Five, Inc., 2261 Market Street, San Francisco, CA 94114, USA

Sending our emails (waitlist confirmation, reminders, launch news)

Data: Email address, name if given, the email's content
Where: USA
Kept by provider: Per Resend's delivery logs
Used: When we email you

Apple Push Notification service

Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA

Push alerts for important messages in the iOS app

Data: Device token, the sender's name and the subject of the message, unfiltered
Where: USA
Kept by provider: Per Apple, until delivered
Used: Only if you turn on push alerts

Meta (Pixel, Conversions API)

Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland

Measuring our ads on Facebook and Instagram

Data: Usage and device data, cookies; on a waitlist sign-up a hashed (SHA-256) email address, IP address and browser
Where: EU and USA
Kept by provider: Per Meta
Used: Only with your consent in the cookie banner

Microsoft Clarity

Microsoft Ireland Operations Ltd., One Microsoft Place, Leopardstown, Dublin 18, Ireland

Heatmaps and session replays to find hard-to-use spots

Data: Mouse movement, taps, scrolling, device data, cookies; form input is masked by Clarity
Where: EU and USA
Kept by provider: Per Microsoft, up to 13 months
Used: Only with your consent in the cookie banner

Supabase (being phased out)

Supabase, Inc., 970 Toa Payoh North #07-04, Singapore 318992

Former database; read only to move older accounts over and as a fallback for two-factor setups made before the move

Data: For accounts from before the move: two-factor setup, memory entries, skills and usage counters; deleted with “Delete all my data”
Where: EU (Ireland)
Kept by provider: Until the move is finished or you delete your data
Used: Only for accounts created before the move