These are every company that handles data on our behalf. Each is bound by a written data processing agreement to act only on our instructions, keep your data confidential, apply appropriate security, and delete or return it when the service ends. This is the canonical list — our Privacy Policy and GDPR notice point here rather than repeating it, so there is only one page to be wrong.
Subprocessors
Last updated: 4 August 2026
| Processor | What it does | What it receives | Where |
|---|---|---|---|
| Anthropic | The language model behind the humanizer | The text you submit for rewriting | United States |
| Supabase | Application database | Account record, and submitted text with its result | United States |
| DigitalOcean | Hosting for the API and the in-house detector | All request data in transit; detector runs here | United States |
| Vercel | Website hosting and edge delivery | Request metadata, including IP address in transit | United States |
| Upstash | Rate-limit and quota counters | Account ID, or IP address for signed-out visitors, held 48 hours | United States |
| Postmark | Transactional email — verification, password reset | Email address only. Never your submitted text | United States |
| Sentry | Crash and error reporting | Diagnostic data. Session replay is disabled; no submitted text is attached | United States |
| Google Analytics | Aggregate site measurement | Page views with IP anonymisation on and advertising signals offLoads only if you accept analytics cookies | United States |
| PostHog | Aggregate product measurement | Page and feature usage eventsLoads only if you accept analytics cookies | United States |
| Sign in with Google | Email address and name, to verify the sign-inOnly if you choose that sign-in method | United States | |
| Apple | Sign in with Apple | Email address (or relay address) and nameOnly if you choose that sign-in method | United States |
| StripeNot live yet | Payment processing | Billing details and payment method. Card numbers go to Stripe, never to us | United States |
Not in use yet
Stripe is listed because the integration exists in our code, but it is not processing anyone's data today. Nothing can be purchased on HumanFlow at the moment. This page will say so on the day that changes, before it changes.
Where your data goes
Every processor above operates in the United States, and we operate from India. If you are in the EEA or the UK, that means your data is transferred outside it. Those transfers rely on Standard Contractual Clauses in each processor's data processing agreement. India has no EU adequacy decision, so the transfer to our own infrastructure rests on the same clauses rather than on adequacy — we would rather state that plainly than let the word "adequacy" do work it cannot do here.
What is not on this list
Our detector runs on a model we trained ourselves, on our own infrastructure. Your text is not sent to any third-party detector — not to Turnitin, not to GPTZero, not to anyone. We do not use advertising networks, data brokers, or retargeting pixels, so none appear here.
Changes
We will update this page before a new processor begins handling your data, not after. If you hold a data processing agreement with us, we notify you by email at least 30 days before adding one, and you may object.
Questions
Email support@humanflow.pro. If you need a signed data processing agreement for your organisation, ask and we will send one.