Sub-processors
Draft for legal review. Not in force. Last updated: [date of publication]
The services that process customer data on Trailcam's behalf. We tell customers (Owners, by email, and on this page) at least 30 days before adding one, so they can object under the data processing agreement.
| Sub-processor | What it does for Trailcam | Data it handles | Where |
|---|---|---|---|
| Cloudflare, Inc. | Runs the app and API (Workers, Durable Objects), stores builds and recordings (R2), delivers email (Email Service), runs Trailcam AI's models (Workers AI), checks sign-ins aren't bots (Turnstile) | All customer data | United States (and Cloudflare's global network for delivery) |
| PlanetScale, Inc. | Hosts Trailcam's database | Accounts, workspaces, flows, run results, audit logs | United States |
| Stripe, Inc. | Payments, invoices and tax | Billing contact, address, tax IDs, payment details (held by Stripe) | United States |
| [Device host provider] | Rents the Macs and Linux servers where runs happen on simulators and emulators | Builds, flows and recordings while a run is in progress | United States |
| Google LLC | Sign-in with Google, when a person chooses it | Name, email address, profile picture | United States |
| GitHub, Inc. | Sign-in with GitHub, when a person chooses it; status checks and comments on linked repositories | Name, email address, profile picture; run results posted to the customer's repositories | United States |
Only when a customer uses them: Google and GitHub (above), and Anthropic, PBC: Claude models, reached through Cloudflare's AI Gateway, for Describe it (doing a described journey and writing its flow) and Find my journeys (looking round a build and proposing journeys). It handles the text of the app's screens on the way; a test account's details, and the details given to Describe it, reach it only by name. Anthropic doesn't train models on it. United States.
Functional Software, Inc. (Sentry): error reports from the app and its servers, so Trailcam can find and fix its own bugs. Reports are scrubbed of customer data before they leave (no cookies, request bodies, query strings, secrets in links, email addresses or keys); a report names a person only by an opaque ID. Stored in the United States. [Listed here before it's switched on.]