Subprocessors - ProductBrain

ProductBrain Subprocessors

Version: 2026-06-17
Last updated: 17 June 2026

ProductBrain (operated by Trisafe, ABN 34 935 278 644) engages the third-party providers below to help deliver the Service. Each is a "subprocessor" that may Process personal data on our behalf. We require each subprocessor to be bound by data-protection obligations consistent with our Privacy Policy and our Data Processing Addendum, including, where they Process your planning content, an obligation not to use it to train AI models or to mine it.

Change notices. We maintain this list as a versioned page. Customers may request advance notice of additions or replacements of subprocessors by emailing privacy@productbrain.com. Where a Data Processing Addendum is in place, we provide at least 30 days' advance notice and a right to object on reasonable data-protection grounds.

Current subprocessors

Subprocessor	Purpose	Data shared	Processing region	DPA status
Supabase	Database and real-time synchronization	All account and planning (brain) data	United States (AWS us-west-2)	Standard DPA available
Google LLC (Gemini API)	AI-assisted drafting, semantic search (text embeddings), and task classification	Content submitted to AI features; text of nodes created/updated; task titles and descriptions; and search queries	United States (Gemini API via a paid Google Cloud project)	Google Cloud CDPA + paid-tier terms (no training; paid billing confirmed)
Clerk	Authentication and user management	Email address, name, account credentials	United States	Published DPA
Vercel	Application hosting and delivery	IP address, browser information, usage logs	United States	Published DPA
PostHog	Product analytics and session replay	Usage events, identified user ID, device/browser metadata, and session recordings with all text and inputs masked	European Union (EU Cloud, `eu.i.posthog.com`)	Published DPA
Resend	Transactional email delivery	Email address, email content	United States	Published DPA
Paddle	Merchant of Record and payment processing (all markets)	Billing information, payment details, tax information	European Union	Paddle is Merchant of Record (own controller for payment data) — reference Paddle DPA

Subprocessor

Purpose

Data shared

Processing region

DPA status

Supabase

Database and real-time synchronization

All account and planning (brain) data

United States (AWS us-west-2)

Standard DPA available

Google LLC (Gemini API)

AI-assisted drafting, semantic search (text embeddings), and task classification

Content submitted to AI features; text of nodes created/updated; task titles and descriptions; and search queries

United States (Gemini API via a paid Google Cloud project)

Google Cloud CDPA + paid-tier terms (no training; paid billing confirmed)

Clerk

Authentication and user management

Email address, name, account credentials

United States

Published DPA

Vercel

Application hosting and delivery

IP address, browser information, usage logs

United States

Published DPA

PostHog

Product analytics and session replay

Usage events, identified user ID, device/browser metadata, and session recordings with all text and inputs masked

European Union (EU Cloud, eu.i.posthog.com)

Published DPA

Resend

Transactional email delivery

Email address, email content

United States

Published DPA

Paddle

Merchant of Record and payment processing (all markets)

Billing information, payment details, tax information

European Union

Paddle is Merchant of Record (own controller for payment data) — reference Paddle DPA

Notes

AI content (Google). Your planning content reaches Google in three ways: when you use AI-assisted features, when node text or search queries are turned into embeddings for search, and when a new task's title and description are classified. All are processed under our paid Google Cloud project and Google's Customer Data Processing Addendum (CDPA); under those terms Google does not use the content to train its models. Google may retain inputs only briefly for abuse monitoring and legal compliance. See Privacy Policy §7.

Payments (Paddle). Paddle acts as Merchant of Record and is the controller for payment-card data; ProductBrain does not store full card details.

This list reflects the subprocessors currently active in the Service. We keep it up to date as our subprocessors change.