Subprocessors

Who else touches your family's data

Last updated: 12 October 2026

This page is part of the Privacy Policy. It exists on its own because it is the part most likely to change, and we would rather change one page honestly than quietly edit a paragraph buried in a longer document.

What this page is

Pairent records your family's day, transcribes it, and turns it into something you can read and listen to. Doing that means other companies handle some of your family's data on our behalf. Storage, transcription, the AI models that do the reading and writing, error monitoring, email. These companies are called subprocessors.

Four things worth noting:

Your family's data is stored and processed by other companies. Raw audio of your family leaves your phone. It travels encrypted to our storage provider, which also keeps it encrypted at rest, and from there through the servers that run our backend, which also encrypt everything they send and receive, to our own speech-to-text software. We do the transcription ourselves rather than sending your recordings to a speech-to-text company: the software is ours, and it runs on computers we rent by the hour in Europe, where the GDPR applies, from Verda by default. Our system rents Verda's computers only in Finland or Iceland, both in the European Economic Area, and by Verda's own account its data centres run on 100% renewable energy. The audio reaches those computers over an encrypted connection too. Our software holds it only in their memory while transcribing it and never writes it to their disks, and we delete each computer when the night's transcription is done; the Verda and RunPod rows say what that does and does not protect against. Apart from a comparison we run on the founder's own account, a recording goes to an outside speech-to-text provider only when our own transcription has not given us a usable transcript of it, as a last resort (the AssemblyAI row lists when that happens). Transcripts of your day, with your children's real names attached to who said what, go to our AI providers, and photographs of your children go to two of them. Until 27 August 2026, if you had iCloud Backup switched on, a copy of the recordings still sitting on your phone went to Apple as well. The app now marks that folder to stay out of new backups, with the two limits the Apple row sets out, one of them being that a backup already taken still holds what it holds. We are not going to describe any of that as "anonymized" or "de-identified", because it is not.

Voiceprints do not leave for identification, but they are stored like everything else. The biometric voiceprints we use to tell family members apart are created and matched by software we run ourselves, on the servers we rent and control. No voiceprint is sent to an outside voice-recognition service, and no outside company hears a voice or receives a voiceprint to identify anyone. One step does go to an outside company, as text rather than audio: when a voice matches two or more of your family's voiceprints too closely to tell apart, our software sends that speaker's lines from the transcript, with a few lines either side and the names and ages of your family members, to one of the AI companies in the Anthropic and OpenAI row (OpenAI by default), and asks which of those people it was. We use the answer only when it names one of them with high confidence; otherwise the voice is left unnamed. The voiceprints themselves are stored in our database at Supabase, which is why Supabase appears in the table below with "voiceprints" in its row. The short recording you make to enroll is used once to build the voiceprint, and since 27 September 2026 it is never stored. A clip kept from an enrollment before that date can still be in Supabase file storage, and is deleted with your account.

We also compute a voice profile for people who never enrolled. To match a recording against your family's stored profiles, our pipeline briefly computes the same kind of profile for every distinct voice in that recording, including people who never enrolled: a visiting relative, one of your children's friends, a babysitter. Those profiles exist only for the length of the match and are then discarded. They are never stored and they never leave our own servers. The audio those voices are in is transcribed exactly as your own family's is, on the same rented computers.

None of these companies pay us for your family's data, and none of them are advertisers. We pay them. We do not sell your family's data to anyone. We have opted out of AI-model training with every provider that offers an opt-out, and the providers that offer no opt-out, or whose terms we have not verified in writing, are named in the tables and in the "Training, retention, and written agreements" section below.

How to read the tables

The Status column means:

1. Companies that receive your family's content

These are the ones that matter most. Each of these receives audio of your family, text of what was said, photographs, or your children's names.

Where this data is processed. Transcription happens in Europe. The computers our own speech-to-text runs on are in Finland or Iceland by default, and always inside the European Economic Area when we use RunPod; audio goes to AssemblyAI in the United States only as a last resort, for a recording our own transcription could not handle (the AssemblyAI row lists the cases), and for the comparison transcript it makes on the founder's own account. Your stored data and the servers that run our backend are in the United States, as are the AI companies that read your transcripts and write what you read and hear. Three other services are in Europe: error reporting runs in the European Union, the sign-in email provider in table 2 is French-domiciled, and the beta application form in table 2 stores its answers in the European Union. Four cannot be pinned to a country at all, and their rows say so rather than guess: the small database in the Cloudflare row that holds waitlist addresses and page counts, Healthchecks.io in table 3, the speech service at xAI, which does not guarantee where it processes a request, and an iCloud backup, for the reason set out in the Apple row. Separately, the website itself and the script host in table 3 are served from whichever content-delivery edge is nearest you.

All of our model comparison runs behind one gate. There are three comparison arms today, two OpenAI models and one Anthropic model, and all three are governed by the same internal allowlist, which today contains only the founder's own account. One of the three reads a second transcript of the same day, made by AssemblyAI, instead of the one our own speech-to-text produced, which is why the AssemblyAI row lists a comparison transcript. The review tool at Vercel lists the output of those same runs for rating, so what it lists is bounded by the same list. If your account is not on it, none of those comparison calls happen for your day at all and the tool has nothing of yours to list, although, as its row says, it can read any family's recordings and transcripts, yours included.

Our providers have providers. The companies above run on infrastructure they rent from others: our database provider's US East region is Amazon's, for example. We list the companies we have a direct relationship with. Each of them publishes its own list of who it relies on.

One thing no company on this list does: identify your family by voice. Speaker identification by voice runs entirely on our own infrastructure. No outside company receives a voiceprint to match against anyone. Supabase stores the voiceprints and Fly.io processes them, which is why both are named in the table above.

2. Companies that receive account or device data, and one link to your content

Google Fonts used to sit in this table. The website has served its own font files from pairent.app since 16 September 2026, so nothing you load from this site reaches Google any more. One page that is built but switched off, the page for sharing a month of your family's story, still loads its fonts from Google; we will serve them ourselves before that page is ever switched on.

3. Companies that receive no recordings, transcripts or photos

Listed for completeness, because a list that quietly omits things is not worth publishing.

We also download software from package registries and model hosts when we build Pairent: Hugging Face, PyPI, npm, Docker Hub and similar. Nothing about your family goes to them; that traffic runs one way, towards us. We have not listed them individually because they receive no data at all.

4. One thing you send yourself, not us

When you tap share on a quote, Pairent hands the card to your phone's share sheet and you choose where it goes: Messages, a social app, whatever you pick. That destination is not our subprocessor and we have no agreement with it. The card carries your child's words and a link to pairent.app. We mention it because it is the one place your family's data leaves Pairent by your hand rather than ours.

Training, retention, and written agreements

Do these companies train their AI models on your family's data?

How long do they keep it?

Pairent deletes raw audio from its own servers within 48 hours of upload, whether or not we processed it. The one exception is the small fixed set of the founder's own family recordings we keep permanently in a separate bucket to test speech-to-text vendors against; no other household's audio is exempt from the 48-hour clock. Audio on your phone follows the same 48-hour clock, and a recording whose upload failed for good is deleted from the phone after 06:00 on the day after it was recorded, with the one exception the Apple row sets out. Our providers run their own clocks, which we do not control:

• AssemblyAI, on the occasions it is used: audio auto-deletes within 24 to 48 hours. We issue a delete for the transcript as soon as we have retrieved it. If that delete fails we log it and the transcription still succeeds, so on a bad day a transcript can survive on their servers longer. AssemblyAI's own default is to keep transcripts indefinitely, which is why we delete them rather than relying on a clock.
• Anthropic: inputs and outputs are deleted within 30 days. Work we submit to Anthropic in batches is not eligible for the zero-retention arrangement at all, and Anthropic would hold it for 29 days; Pairent deletes each batch as soon as it has collected the results, and keeps retrying a delete that fails. If Anthropic's automated safety systems flag something we sent, it may hold that content for up to two years and keep automated safety scores for up to seven. Those holds are theirs, not ours, and no arrangement we could buy would switch them off.
• OpenAI: up to 30 days for abuse monitoring, for its analysis and writing work as well as images. OpenAI keeps files sent through its batch service until they are deleted, and Pairent deletes them as soon as it has collected the results. A US court order once required OpenAI to preserve API data past that window; that obligation ended in September 2025, months before Pairent sent OpenAI anything, so no family's data was ever caught by it. A future court order could do the same thing again, to us or to any provider on this page, and that is not something we can promise our way out of.
• xAI: under the Zero Data Retention mode we send through, the script is deleted once the audio is returned, and within an hour at most, with no logs, backups or other copies kept for any purpose. The flip side is that xAI holds nothing it could later show us or anyone else.
• Sentry: error reports are kept for 30 days, fixed by our plan. Sentry sets it at the moment an error arrives and offers no way to shorten it and no zero-retention option at our size.
• Supabase: customer-controlled, with a 30-day deletion window after termination.
• Resend: 90 days after termination.
• Fly.io: says only that it deletes an account's profile within 30 days of a deletion request. It publishes no clock for the application logs our backend writes there, which is the part that matters here, and we are not going to invent one.
• Expo and Apple: Expo says notification content is never stored and is handled only for as long as it takes to send. Neither company publishes a retention period for a push token. An iCloud backup is not on a clock at all: it persists until you delete it or turn iCloud Backup off, which is why that switch is the real control.
• Vercel and Brevo: we could not establish a published retention period for the data we send each of them. We would rather write that than publish a number we cannot stand behind. We will ask each of them in writing and update this page with the answer.
• Cloudflare: the waitlist addresses and the page counts are in our own database, and nothing there expires on its own: they stay until we delete them. Cloudflare's own analytics of requests to this site are kept eight days on the plan we are on, which we measured against our own site on 18 August 2026.

We do not claim "zero retention" anywhere, because it would not be true.

Written data-processing agreements

We are going to be blunt about this one because the alternative is a claim we cannot support. A written data-processing agreement is the contract that legally binds a provider to handle your data only as we instruct. As of the date on this page, five of these agreements are in force automatically, because the provider writes the agreement into the standard terms we accepted rather than signing a separate copy with each customer: AssemblyAI's, Anthropic's, OpenAI's, xAI's and Verda's. One we have signed and had countersigned, RunPod's, on 19 August 2026. With the rest, including Supabase, Fly.io, Sentry and Expo, there is no data-processing agreement in place at all, and closing that gap is on our list before the beta widens. Two honest notes on the five. An agreement that applies by incorporation is the provider's own standard wording, not something we negotiated or countersigned, and none of it has been reviewed by a lawyer for us. And this page said until 29 September 2026 that OpenAI's was not in place: it is, through the services agreement we accepted, which is a correction in our own favour, so we would rather point at it than let it pass quietly. We would rather say all of that here than let you assume it is finished.

When this list changes

This page is maintained by hand by one person. Here is what we commit to, and nothing heavier, because we would rather keep a small promise than break a large one:

1. We update this page when the list changes. Every change gets a dated line in the log below. We do not silently swap a provider out. 2. If a company that receives your family's recordings, transcripts, photographs or voiceprints is added or replaced, we will email the address on your account before it starts receiving anything. That is the category that matters, and it is a small enough list of events that we can actually do it. 3. Changes that do not touch family content (an alerting tool, a font host, a change in how we host the website) are recorded here and in the change log, without a separate email. 4. Where a change expands what we collect from your children or how we use it, the Privacy Policy commits us to asking you to agree again, and to not processing your recordings under the new terms until you do. That commitment governs. This page never promises you less notice than that policy does.

We do not promise advance notice on a fixed number of days, and we do not promise a subscribe-to-changes feed. Pairent is one person in a private beta and those are promises we would eventually miss.

Change log

• 12 October 2026: The daily delivery push no longer carries a link to your coaching audio. It used to carry one, valid for 24 hours, which passed through Expo and Apple and stayed with the notification on your phone. The app now fetches the audio from us when you press play, and our server removes any link from a notification before it leaves. The push also stopped saying how long that day's audio is and what kind it is, which nothing on your phone used. The Expo and Apple rows are updated.
• 12 October 2026: Verda's row, and the two places above it that say where its computers are, now say Finland or Iceland instead of Finland alone. Our system rents Verda's computers only in those two countries. Verda's Iceland data centre is closed today, which is why the 3 October entry below took Iceland off this page, but our system would rent there again if it reopened, and this page should not depend on that never happening. Iceland is in the European Economic Area but not in the European Union, so the row now says the EEA where it said the EU. Nothing in this entry adds a company or changes what reaches Verda.
• 12 October 2026: Three corrections about transcription, so that this page says what our system does today. First, our own transcription has run for every account since 3 October 2026. The page said 1 October, which is when the founder's own account moved; every other account moved two days later. Second, since 5 October 2026 the computers we rent from Verda and RunPod hold your family's audio only in memory while transcribing it, and our software never writes it to their disks. Until then, any recording longer than about 30 seconds was written to the rented machine's disk, unencrypted, until the machine was deleted, and the two rows went on saying so after it stopped being true. They now say what changed and what it does not protect against: the company we rent from can read a running machine's memory, and on RunPod the computer underneath can move memory onto its own disk. Third, the AssemblyAI row now lists each case in which a recording falls back to it, including one the page did not mention: a second copy of a moment recorded on both the recording device and the phone, when the copy we kept turns out to be unusable. Nothing in this entry adds a company.
• 5 October 2026: Another line-by-line re-reading of our code against this page found seven things it said that were not true, and they are corrected. The top of the page said no third party ever matches a voice to a named person. No outside company hears a voice, but when a voice matches two or more of your family's voiceprints too closely to tell apart, one of the AI companies in the Anthropic and OpenAI row reads that speaker's lines from the transcript and, when the words make it clear, says who it was. The page now says so. The Vercel row said no other family's quotes or audio were reachable from the review tool. The tool lists only accounts on our comparison list, but it can read any family's recordings and transcripts, and the row now says so. The page said the voice-enrollment clip is kept beside the voiceprint; since 27 September 2026 it is used once and never stored. The Apple row said a recording whose upload failed for good stays on your phone indefinitely; the app deletes it after 06:00 on the day after it was recorded. The retention list said Anthropic holds our batched work for 29 days; since 27 September 2026 we delete each batch once we have its results. The RunPod row said we turn to it for a machine that cannot be taken back part-way through a run; we use it when no suitable Verda machine is available. And OpenAI's story-art status called illustrations a setting; they are a switch on our side that covers every account. Nothing in this entry changes what reaches anyone: it changes what this page admits.
• 3 October 2026: We now transcribe recordings ourselves. Since 1 October 2026 Pairent's own speech-to-text software, running on computers rented in Europe from Verda (and from RunPod when no suitable Verda machine is available), turns recordings into words, instead of AssemblyAI. AssemblyAI is now a last-resort fallback for any recording our own transcription fails on, and still makes a second transcript for comparison on accounts on our internal comparison list (today the founder's own), so its row stays. Verda's row now says Finland only, because its Iceland data centre has closed. The comparison arm that used to read our own transcript now reads AssemblyAI's instead, since ours is the one production uses. Sentry's retention is now stated: 30 days for error reports. The page now also says which steps are encrypted, and where we cannot say that something is encrypted on disk. We also removed the "Not in use today" section. None of what it listed receives any family's data: the standby providers it named (Deepgram, LMNT and Google's Gemini) are not in use, and the speech vendors we test by hand are tested only on the founder's own family's recordings.
• 29 September 2026: Stopped counting RunPod data centres on this page and named the guarantee instead: processing stays inside the European Economic Area, in the countries listed. The count was accurate for about six hours at a time and told you nothing useful, while the countries are what actually bounds where your family is heard. If we add a country, this page changes first. Our own tooling now warns us when RunPod adds capacity, and tells us which of those two cases it is.
• 29 September 2026: The RunPod row said nine data centres; it is twelve. Our own list had not been updated since August and was missing three sites RunPod has added in Iceland and Norway, so we were using less of Europe than we could. The countries on the list have not changed, and no recording has been processed anywhere other than the countries named in the row.
• 29 September 2026: A line-by-line re-reading of our own code and configuration against this page, which found eight things wrong and fixed them all. Cloudflare has hosted pairent.app, held the waitlist and counted page views since 18 August 2026 and was not named anywhere on the page, while Netlify, which it replaced, still had a row saying it hosted the site and received the waitlist form; Netlify's row is gone and Cloudflare's takes its place. Tally, which runs the beta application form, was missing too and now has a row. The Apple row and the paragraph above the tables said we had not built the switch that keeps recordings out of device backups; we shipped it on 27 August 2026, and both now say so, with the two limits that still apply: it is best effort and not yet confirmed against a real encrypted backup, and it does nothing about backups already taken. The model comparison paragraph said five arms, all OpenAI; there are three, and one of them is Anthropic. The Vercel row pointed at a "discrepancies" section that does not exist on this page. The Resend row left out the invitation we send when you ask another adult in your home to sign their consent, which carries that adult's name and email address. The Google Fonts row said the fonts load on every page of this website; they have been served from pairent.app since 16 September 2026, and the row has moved to section 4 because the only thing left that loads them is a share page that is switched off. And the code reviewer in table 3 was named as Anthropic; it is OpenAI's Codex, and it reviews when we ask it to rather than automatically. Two consequences of those corrections: the note on where data is processed now names all four European exceptions rather than two, and the written-agreements paragraph now says which agreements apply automatically (five, including OpenAI's and xAI's) and which one is countersigned (RunPod's). Nothing in this entry changes what reaches anyone: it changes what this page admits.
• 29 September 2026: Corrected the RunPod row added yesterday. It said the work runs in “a European Union region we choose”. Four of the nine data centres we allow are in Iceland and Norway, which are in the European Economic Area but not in the European Union, so the row now names every country on that list and says which are which. It also adds what RunPod told us about data centre failure: the work can be moved, they keep it in the same region where they can, and they tell us. And it says plainly that Verda, not RunPod, is the one we use by default.
• 29 September 2026: Removed a duplicate xAI row. The 26 September correction added the rewritten row without taking the old one away, so for three days this page listed xAI twice and gave two different answers for where it processes a request. The corrected row, the one that says the location is not guaranteed, is the one that stays.
• 28 September 2026: Added the two companies that rent us the computers our own speech-to-text runs on, Verda and RunPod. They were missing from this page: both receive raw audio of the family on any account we have enrolled in that test, which today is the founder's own. Neither transcribes anything; they supply the machine our software runs on. RunPod keeps the identity of the data centre operators behind its European capacity confidential, and offered us the names only under an agreement that would have forbidden us to repeat them and would not have told us where those operators are. We declined it, and we would rather write that here than leave the gap unexplained.
• 26 September 2026: Corrected xAI's entries. Its standard data processing addendum applies automatically under its enterprise terms, so "No Pairent DPA is executed" read as if no agreement applied; the row now says what does. Its no-training term is qualified by what xAI discloses to us and by settings we control, so we no longer call it unconditional. Its speech service does not guarantee where it processes a request, so the location column says so. xAI's retention clock is added to the list above. Nothing about what xAI receives changed.
• 24 September 2026: Anthropic and OpenAI now share one row for analysis and writing, instead of each task being assigned to one of them. Which of the two handles a given task can change over time, and either may handle any of them, so the row says what they receive between them, by kind of data, and that neither receives any audio of your family. The practical change is that OpenAI, not only Anthropic, may now receive your family's transcripts. OpenAI keeps a second row for images and the standby voice. Removed Moonshot AI: no comparison model has used it since 11 August 2026, and using it again would take a change to Pairent's code, not a setting. If that ever changes, it returns to this page first.
• 22 September 2026: OpenAI's row adds the monthly letter, which OpenAI now writes in place of Anthropic. Once a month it receives the past month's material: your children's names and ages, the month's day records, the short daily notes and weekly recaps for any days the records do not cover, the kid quotes featured in the weekly recaps, the captions of the month's keepsake photos, the month's changes to your children's favorites, and how the month's coaching went. It never receives the transcript or any audio, but the quotes are your children's own words.
• 21 September 2026: OpenAI's row now covers the family facts written from the same day's recordings as well as the day record, for every household rather than only the founder's, and says what happens when it cannot check one. It adds Ask Pairent, which sends your family's memory to OpenAI to answer a question, and lists what that includes. It never includes the full transcript or any audio, but saved quotes and moments carry your children's own words.
• 17 September 2026: OpenAI's row adds a check of Pairent's written record of each day, run before the record is saved, for a child's exact words and health details it must not keep. It receives those records, never the transcript or any audio, and runs only for enrolled accounts (today the founder's own household).
• 21 August 2026: Added xAI, which has read the daily show aloud since 20 August 2026; OpenAI's row narrowed to illustrations, portraits and the fallback voice. Moonshot AI moved from enrolled-only to standby: no comparison arm has used it since 11 August 2026. Noted that the in-app voice picker was removed on 20 August, so the voice is no longer a per-account choice. This page was published on this date; before it, the provider list lived only in section 4 of the Privacy Policy, which did not name every company below.
• 3 August 2026: First version of this page. The provider list was moved here from section 4 of the Privacy Policy and extended with providers that section 4 did not name: Vercel, Pushover, Healthchecks.io, jsDelivr, GitHub, the code-review arrangement in our build system, LMNT, Google (Gemini, standby), the evaluation-only vendors, and Google Fonts (which section 10 disclosed for the website but section 4 did not list). Two disclosures were added that no earlier document made: that recordings still on your phone reach Apple through iCloud Backup unless you turn it off, and that the daily push carries a 24-hour link to that day's coaching audio.

Questions

If something on this page is unclear, or you want to know exactly what left your account and when, email support@pairent.app.

See also the Privacy Policy and theTerms of Use.